Categories: Malware

Cerbu.90700 malicious file

The Cerbu.90700 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Cerbu.90700 virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Presents an Authenticode digital signature
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
CAPE detected the embedded win api malware family
Yara detections observed in process dumps, payloads or dropped files

How to determine Cerbu.90700?


File Info:
name: C1CF32D6750CD40B9DC2.mlwpath: /opt/CAPEv2/storage/binaries/03af8271cfcaad7b77d80744030e06c4b8c018edd42d57b017db685c57c6b21ccrc32: 0E73A0F7md5: c1cf32d6750cd40b9dc21b837c0ccaacsha1: cc1dd6a855e10dbc792a0bc64004ccc261461527sha256: 03af8271cfcaad7b77d80744030e06c4b8c018edd42d57b017db685c57c6b21csha512: f1683451c0e10ab30d5a765fd55ed472fff87911151182c127f18b1eb4faea5ccd277a161f555667a81a56fc6efcc335fc7ce9b086a578ddf24adc1a4f593c30ssdeep: 6144:HlwCx1SYEdaaozQgHQQN+JWNPTL1ewYe7KxNuH:KCx1SRa/5nNKeL1f7gMHtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T176D4F21DB4887F33F9F292741407E272E0BADD1522237C4767E0F54ABAB06A919323B5sha3_384: cc716d472f40a137aaa07939f753cc4c8ad813c2169eb46b97ca85fd4a83a028c15edf32988e15dc9938b598730d915dep_bytes: 558bec833d3815490000740f6a15e80dtimestamp: 2021-02-10 15:42:54
Version Info:
CompanyName: Microsoft CorporationFileDescription: Command Line Interface for Microsoft® Volume Shadow Copy Service FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)InternalName: VSSADMIN.EXELegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: VSSADMIN.EXEProductName: Microsoft® Windows® Operating SystemProductVersion: 6.1.7600.16385Translation: 0x0409 0x04b0

Cerbu.90700 also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Cerbu.90700
FireEye	Generic.mg.c1cf32d6750cd40b
Skyhigh	GenericRXNP-ZQ!C1CF32D6750C
McAfee	GenericRXNP-ZQ!C1CF32D6750C
Malwarebytes	MachineLearning/Anomalous.100%
Zillya	Downloader.Cridex.Win32.309
Sangfor	Trojan.Win32.Save.a
K7GW	Trojan ( 00577a711 )
K7AntiVirus	Trojan ( 00577a711 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HJJV
APEX	Malicious
Avast	Win32:DangerousSig [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Qshell.vho
BitDefender	Gen:Variant.Cerbu.90700
Tencent	Malware.Win32.Gencirc.115cc51f
Emsisoft	Gen:Variant.Cerbu.90700 (B)
F-Secure	Trojan.TR/AD.Dridex.wfq
DrWeb	Trojan.Dridex.735
VIPRE	Gen:Variant.Cerbu.90700
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
Jiangmin	Trojan.Qshell.dx
Google	Detected
Avira	TR/AD.Dridex.wfq
MAX	malware (ai score=83)
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Kingsoft	malware.kb.a.1000
Microsoft	Trojan:Win32/Dridex.KD!MTB
Arcabit	Trojan.Cerbu.D1624C
ZoneAlarm	HEUR:Trojan.Win32.Qshell.vho
GData	Gen:Variant.Cerbu.90700
Varist	W32/Dridex.CA.gen!Eldorado
AhnLab-V3	PUP/Win32.RL_Generic.R366129
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.36804.Ly1@aKbFx8gi
ALYac	Gen:Variant.Cerbu.90700
VBA32	BScope.Trojan-Spy.Zbot
Cylance	unsafe
Panda	Trj/GdSda.A
Rising	Downloader.Cridex!8.F70 (TFE:4:g2lv3Qpu5SL)
Ikarus	Trojan.Crypt3
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.HJJV!tr
AVG	Win32:DangerousSig [Trj]
DeepInstinct	MALICIOUS