About “Trojan-PSW.MSIL.Cerna.jm” infection

The Trojan-PSW.MSIL.Cerna.jm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-PSW.MSIL.Cerna.jm virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• At least one process apparently crashed during execution
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Russian
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Created a process from a suspicious location
• Steals private information from local Internet browsers
• Collects information about installed applications
• Attempts to identify installed analysis tools by a known file location
• Attempts to identify installed AV products by installation directory
• Detects Bochs through the presence of a registry key

How to determine Trojan-PSW.MSIL.Cerna.jm?

File Info:
name: C04DCFA616460CCF36C4.mlw
path: /opt/CAPEv2/storage/binaries/85f0622b898a327206768bf6636357b6040f10abd63b7cf57967f84100a2ab66
crc32: A66EDB3B
md5: c04dcfa616460ccf36c494993541639d
sha1: 54cf76ead2a2ff239015cb310ef9552c880e1662
sha256: 85f0622b898a327206768bf6636357b6040f10abd63b7cf57967f84100a2ab66
sha512: 9cfcb0881f1df4e2896d12472129fe91e8868b6dac357bdff0392752d32ba9f66695618b4d2a1223abafa8c935a16fad431cb217548c6194efc9ec652e0a1d0a
ssdeep: 393216:qgVvmofryslF+yM71cqz+ODmy/ctby7qlkMoFn+I6bBo9VYOd:NlD6cimwfFq1CGOd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T175F633D4B32EC479D5572B398447286C20EBE5740F3B59C3EF48A6A931697CBC8BD089
sha3_384: bc3f2df2a73d85823b8ec3baef422c5c1ce5d551a60231fab0d994789c8c60354a0584e14f0e7626705c93d4557f395f
ep_bytes: 558bec6aff6870c4410068c095410064
timestamp: 2012-12-31 00:38:51

Version Info:
FileDescription: IObit Uninstaller PRO
Translation: 0x0804 0x03a8

Trojan-PSW.MSIL.Cerna.jm also known as:

How to remove Trojan-PSW.MSIL.Cerna.jm?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.