Ransom.Cerber.321 malicious file

The Ransom.Cerber.321 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Cerber.321 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
A process created a hidden window
Creates an excessive number of UDP connection attempts to external IP addresses
Performs some HTTP requests
Uses Windows utilities for basic functionality
Exhibits behavior characteristic of Cerber ransomware
Attempts to execute a binary from a dead or sinkholed URL
Writes a potential ransom message to disk
EternalBlue behavior
Attempts to modify proxy settings
Attempts to access Bitcoin/ALTCoin wallets
Generates some ICMP traffic
Collects information to fingerprint the system
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

api.blockcypher.com

hjhqmbxyinislkkt.1j9r76.top

How to determine Ransom.Cerber.321?


File Info:
crc32: 3D21197E
md5: 6bc622d70947b0192934e98a559c630d
name: 6BC622D70947B0192934E98A559C630D.mlw
sha1: b7a460c87cf30e9a0dec9e53473c6a81c1a5b9e4
sha256: 4f4eef403718044dc9a424276170709dc41bed49a1c0782674a51deb5295c54f
sha512: 02cf4aff11463bb67db93020548d3d7d2a435722be41e709870793407ab6861f98303d33228965b4b822c5ffd1c0687a1510434ea4b6f06a29ad3ec180c503f3
ssdeep: 6144:PlKZl30feXONU/8uu4UqVta/CnXOxHQSOKihBFtHmZ3+kGEQNb9IKdT3XkePL:tKYWnD1UqvFMHQtiZ3kL9T3Ug
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2006-2010 Christian Ghisler
InternalName: Totalcmd-udmin
FileVersion: 1, 0, 0, 5
CompanyName: Ghisler Software GmbH
ecialBuild: D
ivateBuild: j%x01ProductName
LegalTrademarks: Nx13x01OriginalFilename
Comments: Tool used internally by Total Commander, do not start directly!
FileDescription: Total Commander udministrator Tool
0, 0, 5:  
sler Software GmbH Totalcmd-udmin: :x0bx01ProductVersion
alcmd-udmin.exe:  
Translation: 0x0409 0x0000

Ransom.Cerber.321 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ransom.Cerber.321
FireEye	Generic.mg.6bc622d70947b019
CAT-QuickHeal	Ransom.Cerber.A4
McAfee	Ransomware-CBER!6BC622D70947
Cylance	Unsafe
Zillya	Trojan.Zerber.Win32.2358
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005224381 )
BitDefender	Gen:Variant.Ransom.Cerber.321
K7GW	Trojan ( 0050aabe1 )
Cybereason	malicious.70947b
Baidu	Win32.Trojan.Kryptik.alb
Cyren	W32/Cerber.F.gen!Eldorado
Symantec	Packed.Generic.459
APEX	Malicious
Avast	Win32:Filecoder-BG [Trj]
ClamAV	Win.Ransomware.Razy-7350762-0
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Ransom:Win32/generic.ali2000010
NANO-Antivirus	Trojan.Win32.Zerber.eoegvh
Rising	Trojan.Kryptik!1.AACA (CLOUD)
Ad-Aware	Gen:Variant.Ransom.Cerber.321
Sophos	ML/PE-A + Mal/Cerber-B
Comodo	Malware@#3ohbrqpuiukg6
F-Secure	Trojan.TR/Crypt.ZPACK.Gen7
VIPRE	Trojan.Win32.Generic.pak!cobra
TrendMicro	Ransom_HPCERBER.SMALY5A
McAfee-GW-Edition	BehavesLike.Win32.PinkSbot.jm
Emsisoft	Gen:Variant.Ransom.Cerber.321 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Ransom.Cerber.321
Jiangmin	Trojan.Generic.garuh
eGambit	Unsafe.AI_Score_99%
Avira	TR/Crypt.ZPACK.Gen7
Antiy-AVL	Trojan/Win32.SGeneric
SUPERAntiSpyware	Ransom.Cerber/Variant
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Ransom:Win32/Cerber
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Cerber.Gen
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34590.Pq2@aC@ovNy
ALYac	Gen:Variant.Ransom.Cerber.321
VBA32	BScope.TrojanSpy.Zbot
Malwarebytes	Cerber.Ransom.Encrypt.DDS
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Kryptik.FQRH
TrendMicro-HouseCall	Ransom_HPCERBER.SMALY5A
Tencent	Malware.Win32.Gencirc.10b0f767
Yandex	Trojan.GenAsa!KgjQsx4pNFA
MAX	malware (ai score=82)
Fortinet	W32/Kryptik.HJJV!tr
Webroot	Trojan.Dropper.Gen
AVG	Win32:Filecoder-BG [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Ransom.Filecoder.HxQBBFsC

How to remove Ransom.Cerber.321?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Ransom.Cerber.321 malicious file