Mal/Cerber-B (file analysis)

The Mal/Cerber-B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Cerber-B virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Creates an excessive number of UDP connection attempts to external IP addresses
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Attempts to modify desktop wallpaper
Exhibits behavior characteristic of Cerber ransomware
Attempts to execute a binary from a dead or sinkholed URL
EternalBlue behavior
Attempts to modify proxy settings
Attempts to access Bitcoin/ALTCoin wallets
Generates some ICMP traffic
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

api.blockcypher.com

btc.blockr.io

bitaps.com

chain.so

ocsp.digicert.com

p27dokhpz2n7nvgr.1lseoi.top

How to determine Mal/Cerber-B?


File Info:
crc32: 9C3AEA72
md5: af03bd78c3aba0fcf80b3e904f50099f
name: AF03BD78C3ABA0FCF80B3E904F50099F.mlw
sha1: 8aa8a8da11cd6084bd08a08080a5a07f71b90c72
sha256: a42a8edcb2f9ff6205b6b6cd4e489318f37500460240ec2150fd85c2958fbec6
sha512: 70769e97ff1996040f9e33bfb2d48c38eabd0e4b91f150493dc593e48d596f65574e46c2f6204a077cdbe2e20a6648a4bbf7c634491b008f29465b3499b2ab39
ssdeep: 6144:t47XYdzOP9O7iJOFiH7HrL9FN0TbgrlhnHwAhMC:tw8u9O7ij7LL93aw/QAhMC
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 Alexander Roshal 1993-2012
InternalName: Command line RAR
FileVersion: 4.20.0
CompanyName: Alexander Roshal
ProductName: WinRAR
ProductVersion: 4.20.0
FileDescription: Command line RAR
Translation: 0x0409 0x04e4

Mal/Cerber-B also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Backdoor ( 005328fd1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.4691
Cynet	Malicious (score: 100)
CAT-QuickHeal	Ransom.Cerber.A4
ALYac	Gen:Heur.FKP.1
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Backdoor ( 005328fd1 )
Cybereason	malicious.8c3aba
Cyren	W32/Kryptik.CUI.gen!Eldorado
Symantec	Packed.Generic.459
ESET-NOD32	Win32/Filecoder.Cerber.H
APEX	Malicious
Avast	Win32:Filecoder-BG [Trj]
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Heur.FKP.1
NANO-Antivirus	Trojan.Win32.Encoder.evjnxz
MicroWorld-eScan	Gen:Heur.FKP.1
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	Gen:Heur.FKP.1
Sophos	Mal/Cerber-B
Comodo	TrojWare.Win32.Ransom.Cerber.FJ@6wjqwh
F-Secure	Heuristic.HEUR/AGEN.1105907
BitDefenderTheta	Gen:NN.ZexaF.34692.pq0@aOtFTkmi
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_HPCERBER.SMALY5A
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.af03bd78c3aba0fc
Emsisoft	Gen:Heur.FKP.1 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1105907
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.22CC33E
Microsoft	Ransom:Win32/Cerber.J
Arcabit	Trojan.FKP.1
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Heur.FKP.1
AhnLab-V3	Win-Trojan/Cerber.Exp
Acronis	suspicious
McAfee	Ransomware-CBER!AF03BD78C3AB
MAX	malware (ai score=100)
VBA32	BScope.Trojan.Packed
Malwarebytes	Malware.AI.491220485
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom_HPCERBER.SMALY5A
Rising	Trojan.Kryptik!1.AE9C (CLASSIC)
Yandex	Trojan.GenAsa!y+ziJ/1HN7o
Ikarus	Trojan-Ransom.Cerber
Fortinet	W32/Zamg.O!tr
AVG	Win32:Filecoder-BG [Trj]
Paloalto	generic.ml

How to remove Mal/Cerber-B?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Mal/Cerber-B (file analysis)