Cerbu.99063 (file analysis)

The Cerbu.99063 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Cerbu.99063 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Detects Sandboxie through the presence of a library
• Detects Avast Antivirus through the presence of a library
• Checks the presence of disk drives in the registry, possibly for anti-virtualization
• Anomalous binary characteristics

How to determine Cerbu.99063?

File Info:
name: ED42F00FDEF87BA1B090.mlw
path: /opt/CAPEv2/storage/binaries/ab0ae71ce204cf123d7381c270dedda221656ce0f0f7c596585d63fa8ec003b9
crc32: 7869837B
md5: ed42f00fdef87ba1b0909aec233617ba
sha1: 0b2a94f81dce53ee5b33633ffa2de09e3598504c
sha256: ab0ae71ce204cf123d7381c270dedda221656ce0f0f7c596585d63fa8ec003b9
sha512: 662199cf799d5b8bb893e1f0f158f15594e62bc1520678d5a251b135938ded58c4773d99ff4cb17fa69a18d73f01f161ac9bbb91e2d4fa6ce4b003e1e1b4f38b
ssdeep: 3072:xoQXAB7IgTLRSxvWI2970wQA2Wpyk5/Bv23k0Y0nOzoImKGfmkkg+A9ReV:6kAex+j972O/eHY0OzkK3W+A/e
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D8044B1976E5E4BCD9A206F22A7CF1A85535BDF29B31418F31C1270E59346D88E32FA3
sha3_384: 088553f9036731bf7d61f420ae1ad168d0333aa0b080400ffa32189de1d7af05fd864a07df91f75d18ecc21cfefa1ee9
ep_bytes: e85a050000e944feffffccccccccccff
timestamp: 2016-02-26 00:13:55

Version Info:
Translation: 0x0409 0x04b0

Cerbu.99063 also known as:

How to remove Cerbu.99063?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.