What is “Ransom.Cerber.974”?

The Ransom.Cerber.974 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Cerber.974 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the Ursnif3 malware family
• Creates a copy of itself
• Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom.Cerber.974?

File Info:
name: D2B4E0E5C5C7D275F548.mlw
path: /opt/CAPEv2/storage/binaries/ba6cce0f3806eb14606d96e1f51134df2ce5c6fea2d417ec4c379c52dc4bbef1
crc32: EB66B734
md5: d2b4e0e5c5c7d275f5482ab0079411aa
sha1: 521a33481d41932e2b2fedf92d46fdd93a0a362b
sha256: ba6cce0f3806eb14606d96e1f51134df2ce5c6fea2d417ec4c379c52dc4bbef1
sha512: 89d14206b6899930bfb54b2c72ec93a1c81f3c29e6feec97e151c278c3ed364b7ad89f83a7bcfa65f7753bd2d168b0fb3ba72e253e9457b614d3d5bc4f0439ae
ssdeep: 12288:3YRIHe5KQfbx7KgC0U1PShJcZWUAZe59xmY17Cv6:IRYQTx7KgCLZWUAZe59kY1P
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1D7C402A2F208A685D5474572686DEC7045A3FCFCB5E4DC1D21EAF0B94CB23E6005E9AF
sha3_384: b1532595b49b519364f9aa098d7d6dc43566a710f36ec72d6674635f8cc826befe3ced3a7880120028be018c6f71159b
ep_bytes: 558bec81ec100300005356578b45f803
timestamp: 2016-07-27 08:01:24

Version Info:
CompanyName: Oracle Corporation
FileDescription: Java(TM) Platform SE binary
FileVersion: 7.0.40.20
Full Version: 1.7.0_04-b20
InternalName: javaw
LegalCopyright: Copyright © 2012
OriginalFilename: javaw.exe
ProductName: Java(TM) Platform SE 7 U4
ProductVersion: 7.0.40.20
Translation: 0x0000 0x04b0

Ransom.Cerber.974 also known as:

How to remove Ransom.Cerber.974?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.