Ransom.Cerbu.29 (file analysis)

The Ransom.Cerbu.29 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Cerbu.29 virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ransom.Cerbu.29?


File Info:
name: EB1FA6DCB626D6606895.mlw
path: /opt/CAPEv2/storage/binaries/c498f92dcebbe69931a8495fc5bfb6da37fdd827dd55ea2ed521868545e352a9
crc32: D2606CE2
md5: eb1fa6dcb626d6606895a161011fef51
sha1: e049a243441afa55561769879b222367db1ddbde
sha256: c498f92dcebbe69931a8495fc5bfb6da37fdd827dd55ea2ed521868545e352a9
sha512: ece1740647abd24504877addca478d0395615f7e05cad303369af01af5ad997668b31a587228ab96d5461a08595cecdc48d727280c2f68cea22bbd3959f5a750
ssdeep: 3072:GcOSB7RoqId5mtT4XOyVop6PsoB7LTKTeFq3PFU0teELdGJi:GetRamR4XOyV5R7LUPS0t30Ji
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E0048C16F744A0BAD5F68175C4C7964AEBB1BA5907118BCF23A4868B1F333E19E39343
sha3_384: bdb623db430e4981d817becfb9d80ab850fb18740a6968de24e58b34c1c02d631bda88739f00501960d022857db65030
ep_bytes: 
timestamp: 2002-07-24 15:15:53

Version Info:
0: [No Data]

Ransom.Cerbu.29 also known as:

Bkav	W32.AIDetect.malware1
DrWeb	Program.RemoteAdmin
MicroWorld-eScan	Gen:Variant.Ransom.Cerbu.29
FireEye	Generic.mg.eb1fa6dcb626d660
ALYac	Gen:Variant.Ransom.Cerbu.29
Cybereason	malicious.3441af
Cyren	W32/Damaged_File.E.gen!Eldorado
TrendMicro-HouseCall	TROJ_GEN.R03BH09A422
BitDefender	Gen:Variant.Ransom.Cerbu.29
Ad-Aware	Gen:Variant.Ransom.Cerbu.29
Emsisoft	Gen:Variant.Ransom.Cerbu.29 (B)
Comodo	Heur.Corrupt.PE@1z141z3
McAfee-GW-Edition	BehavesLike.Win32.Duptwux.cm
SentinelOne	Static AI – Malicious PE
Sophos	Generic ML PUA (PUA)
Antiy-AVL	Trojan/Generic.ASBOL.15B5
Gridinsoft	Ransom.Win32.Heuristic.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Gen:Variant.Ransom.Cerbu.29
Cynet	Malicious (score: 100)
Acronis	suspicious
MAX	malware (ai score=83)
APEX	Malicious
Fortinet	Riskware/Application
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Ransom.Cerbu.29?

Ransom.Cerbu.29 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X