Trojan.Ransom.Cerber.CI information

The Trojan.Ransom.Cerber.CI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Ransom.Cerber.CI virus can do?

• Executable code extraction
• Creates RWX memory
• A process attempted to delay the analysis task.
• Expresses interest in specific running processes
• Reads data out of its own binary image
• A process created a hidden window
• Creates an excessive number of UDP connection attempts to external IP addresses
• Unconventionial language used in binary resources: Portuguese
• The binary likely contains encrypted or compressed data.
• Uses Windows utilities for basic functionality
• Attempts to delete volume shadow copies
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Exhibits behavior characteristic of Cerber ransomware
• EternalBlue behavior
• Generates some ICMP traffic
• Collects information to fingerprint the system
• Anomalous binary characteristics

How to determine Trojan.Ransom.Cerber.CI?

File Info:
crc32: 521C14A3
md5: be00e732c88f3e4ecbebcc11022f256c
name: BE00E732C88F3E4ECBEBCC11022F256C.mlw
sha1: 65490f336878f50ed270cc47fc0e51732552cb65
sha256: ba1573c22b5837c4442c4b5164941fe86a97f7bcd2679518ff6dc8c8fa9d4b32
sha512: 82abbdb7d1036fb5c8f1e767f5b3e33ee57f2e3cff5c0175d7079a9f43a66395442d4aab08fd18af951ef119ca5cac573bd1fcecbbcfe937917269af5a895c30
ssdeep: 6144:dlzJy3qyGpBpFWxPikfRZ98+6GrR/GA3aGskW:k3/MLWxa2RZ98+6e3aGJW
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
eUp Software: Rx15x01FileDescription
Comments: @x10x01CompanyName
eUp Utilities 2014: @x0ex01ProductVersion
yright xa9 AVG Netherlands B. V. 2011: Lx12x01LegalTrademarks
eUp Utilitiesx2122: Lx16x01ProductName
0.1000.340: D
eUp Report Center: <x0ex01FileVersion
Translation: 0x0407 0x04b0

Trojan.Ransom.Cerber.CI also known as:

How to remove Trojan.Ransom.Cerber.CI?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.