What is "Ransom:Win32/Cerber.L!rfn"?

The Ransom:Win32/Cerber.L!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/Cerber.L!rfn virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
A process created a hidden window
Creates an excessive number of UDP connection attempts to external IP addresses
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Attempts to modify desktop wallpaper
Deletes its original binary from disk
Attempts to execute a binary from a dead or sinkholed URL
Writes a potential ransom message to disk
EternalBlue behavior
Attempts to modify proxy settings
Attempts to access Bitcoin/ALTCoin wallets
Generates some ICMP traffic
Collects information to fingerprint the system
Uses suspicious command line tools or Windows utilities

Related domains:

api.blockcypher.com

btc.blockr.io

bitaps.com

chain.so

ocsp.digicert.com

xpcx6erilkjced3j.14pxvn.top

How to determine Ransom:Win32/Cerber.L!rfn?


File Info:
crc32: 39368439
md5: 707aac3e5c7234f138fd73e9347311ef
name: 707AAC3E5C7234F138FD73E9347311EF.mlw
sha1: 9ac426e91d69dcc589a439c8e948c359d77978bf
sha256: 8f38a04bfad323d6bb5ccfc4cc6acd0d2249ec9d3766e9f5ae03ad59da9a95d7
sha512: 60e08f8972e395b3763f83a4d048f8d498db6208db729a24d6eb743dcdb1c33345b5d93da5fb62ac277c03e29b749b60e0ebf41e894344e35f2bf271725bda65
ssdeep: 6144:WbofmLo42NddhaFvfgpY+MszasME92uckLREtPBS:Wbofy7WahfgpY+JqEouFLREB
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: (c) Copyright 2016 StationPlaylist.com
InternalName: 
FileVersion: 5.2.0.1
CompanyName: StationPlaylist.com
LegalTrademarks: 
Comments: 
ProductName: Track Preview
ProductVersion: 5.20
FileDescription: Track Preview
OriginalFilename: SPLPlayer.exe
Translation: 0x1409 0x04e4

Ransom:Win32/Cerber.L!rfn also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 005224381 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.4691
Cynet	Malicious (score: 100)
CAT-QuickHeal	Ransom.Cerber.ZZ4
ALYac	Trojan.Mint.Zamg.O
Cylance	Unsafe
Zillya	Trojan.Zerber.Win32.4361
Alibaba	Ransom:Win32/generic.ali2000010
K7GW	Trojan ( 00513cfe1 )
Cybereason	malicious.e5c723
Symantec	Packed.Generic.459
ESET-NOD32	a variant of Win32/Kryptik.HEXN
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Emotet-6895766-0
Kaspersky	Trojan-Ransom.Win32.Zerber.fnzb
BitDefender	Trojan.Mint.Zamg.O
NANO-Antivirus	Trojan.Win32.Encoder.fncbpv
ViRobot	Trojan.Win32.U.Cerber.416256[UPX]
MicroWorld-eScan	Trojan.Mint.Zamg.O
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	Trojan.Mint.Zamg.O
Sophos	Mal/EncPk-AAT
Comodo	Packed.Win32.MUPX.Gen@24tbus
BitDefenderTheta	Gen:NN.ZexaF.34142.pmKfaKEs80ni
TrendMicro	Ransom_HPCERBER.SMALY5B
McAfee-GW-Edition	GenericRXHB-TN!A3305508B26F
FireEye	Generic.mg.707aac3e5c7234f1
Emsisoft	Trojan.Mint.Zamg.O (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Zerber.czj
Avira	HEUR/Crypted
Antiy-AVL	Trojan/Generic.ASMalwS.2167397
Microsoft	Ransom:Win32/Cerber.L!rfn
Arcabit	Trojan.Mint.Zamg.O
ZoneAlarm	Trojan-Ransom.Win32.Zerber.fnzb
GData	Win32.Trojan-Ransom.Cerber.AL
TACHYON	Ransom/W32.Cerber.416256
AhnLab-V3	Win-Trojan/Cerber.Exp
Acronis	suspicious
McAfee	Artemis!707AAC3E5C72
MAX	malware (ai score=86)
VBA32	Trojan-Ransom.Zerber
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom_HPCERBER.SMALY5B
Rising	Trojan.Kryptik!1.AD41 (CLASSIC)
Yandex	Trojan.GenAsa!2zzygV1Sol4
Ikarus	Trojan.Win32.Filecoder
MaxSecure	Trojan.Malware.74139698.susgen
Fortinet	W32/Zamg.O!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Ransom:Win32/Cerber.L!rfn?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Ransom:Win32/Cerber.L!rfn”?