About "Trojan.Ransom.Cerber" infection

The Trojan.Ransom.Cerber is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Ransom.Cerber virus can do?

Executable code extraction
Creates RWX memory
A process created a hidden window
Creates an excessive number of UDP connection attempts to external IP addresses
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Installs itself for autorun at Windows startup
EternalBlue behavior
Generates some ICMP traffic
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Ransom.Cerber?


File Info:
crc32: 78AAA139
md5: 0027ec786e5e476d88ed5f2aab27829e
name: 0027EC786E5E476D88ED5F2AAB27829E.mlw
sha1: 9d47aa2e07d4b18aa1868527af95103c2510e363
sha256: 4e833eeae662467210dc690c77becc4bd46773e41112502a481c759c7803681c
sha512: 3d1250ad6cf54305228d9f254ad6b3d0ce157561fa9a6f207ea2478952587b847f80c8195e8354ba65dc9fd931e8b46d7c139d43f3a050ad762e28254e3afb76
ssdeep: 6144:CZA9PSWCfUxuNuUelUa4Z/uIjhXOmqGWQnLOpv29ruo+jPRNLIaj8X:n9KWCNbn/dZ89Ma+R+jIaIX
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2005-2015
InternalName: SmartRAM
FileVersion: 9.0.0.22
CompanyName: IObit   
LegalTrademarks: IObit
Comments: Smart RAM
ProductName: Smart RAM
ProductVersion: 9.0.0.0
FileDescription: Monitors and Optimizes memory usage to increase available physical memory.
OriginalFilename: SmartRAM.exe
Translation: 0x0409 0x04e4

Trojan.Ransom.Cerber also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Mint.Zamg.O
FireEye	Generic.mg.0027ec786e5e476d
CAT-QuickHeal	Ransom.Cerber.A4
ALYac	Trojan.Ransom.Cerber
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Generic.4!c
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0054f2ec1 )
BitDefender	Trojan.Mint.Zamg.O
K7GW	Trojan ( 00514a871 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/Cerber.BF.gen!Eldorado
Symantec	Packed.Generic.459
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Ransomware.Cerber-9760825-0
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Ransom:Win32/Cerber.b6d5d009
NANO-Antivirus	Trojan.Win32.Zerber.eryrsr
ViRobot	Trojan.Win32.Cerber.509440.B
Rising	Trojan.Kryptik!1.AD41 (CLOUD)
Ad-Aware	Trojan.Mint.Zamg.O
Emsisoft	Trojan.Mint.Zamg.O (B)
Comodo	TrojWare.Win32.Zonidel.AY@7kn16e
F-Secure	Heuristic.HEUR/AGEN.1128809
Zillya	Trojan.Kryptik.Win32.2318032
TrendMicro	Ransom_HPCERBER.SMALY5B
McAfee-GW-Edition	Ransomware-GCQ!0027EC786E5E
MaxSecure	Win.MxResIcn.Heur.Gen
Sophos	ML/PE-A + Mal/Cerber-AL
Ikarus	Trojan.Win32.Filecoder
Jiangmin	Trojan.Generic.eahhp
Avira	HEUR/AGEN.1128809
MAX	malware (ai score=100)
Microsoft	Ransom:Win32/Cerber.L!bit
Arcabit	Trojan.Mint.Zamg.O
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Win32.Trojan-Ransom.Cerber.AL
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Cerber.Exp
Acronis	suspicious
McAfee	Ransomware-GCQ!0027EC786E5E
TACHYON	Ransom/W32.Cerber.509440.T
VBA32	BScope.Trojan.Encoder
Malwarebytes	Cerber.Ransom.Encrypt.DDS
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Kryptik.FVYF
TrendMicro-HouseCall	Ransom_HPCERBER.SMALY5B
Tencent	Malware.Win32.Gencirc.10b58b67
Yandex	Trojan.GenAsa!9GVqn+7th0g
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	W32/Zamg.O!tr
BitDefenderTheta	Gen:NN.ZexaF.34590.Fq0@aO4mc@aj
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.Generic.HxQBPPsA

How to remove Trojan.Ransom.Cerber?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Trojan.Ransom.Cerber” infection