Categories: RansomTrojan

How to remove “Trojan-Ransom.Win32.Zerber.ftzp”?

The Trojan-Ransom.Win32.Zerber.ftzp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Ransom.Win32.Zerber.ftzp virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • A process created a hidden window
  • Creates an excessive number of UDP connection attempts to external IP addresses
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Exhibits behavior characteristic of Cerber ransomware
  • Attempts to execute a binary from a dead or sinkholed URL
  • Writes a potential ransom message to disk
  • EternalBlue behavior
  • Attempts to modify proxy settings
  • Attempts to access Bitcoin/ALTCoin wallets
  • Generates some ICMP traffic
  • Collects information to fingerprint the system
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
api.blockcypher.com
hjhqmbxyinislkkt.1j9r76.top

How to determine Trojan-Ransom.Win32.Zerber.ftzp?


File Info:

crc32: 4F2D0CB2md5: 7961a8814d08fd3c9a8214b90d439ca0name: 7961A8814D08FD3C9A8214B90D439CA0.mlwsha1: d89a3b8a271724703c37c0cf75aef827cc4af525sha256: 4148780b48335a6080b75d9d881f2c8c4e876ff2d5a0e8787c6fb7fbb5880114sha512: 4a305b9f7525b058d5cf2ff1647be45e02474f6177f1c99701ffdccab3fb00fd00221d048544bfcec9b697f9a6d1a8d08356260848a7b3ec8ad1fc9acfcef33assdeep: 6144:c74dQF188zNDXCaOaX10i6hZzuu72NuuRQ2zSD8bqh:vG8W+a4i6hZzuQbuhzsQKtype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan-Ransom.Win32.Zerber.ftzp also known as:

Bkav W32.AIDetect.malware1
K7AntiVirus Trojan ( 005137001 )
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
DrWeb Trojan.Encoder.10731
Cynet Malicious (score: 100)
CAT-QuickHeal Ransom.Exxroute.A4
ALYac Gen:Variant.Agiala.27
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.1165451
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Ransom:Win32/Cerber.ali1020013
K7GW Trojan ( 0050bd651 )
Cybereason malicious.14d08f
Cyren W32/Cerber.BQ1.gen!Eldorado
Symantec Packed.Generic.493
ESET-NOD32 a variant of Win32/Kryptik.FRMW
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Dropper.Cerber-7174760-0
Kaspersky Trojan-Ransom.Win32.Zerber.ftzp
BitDefender Gen:Variant.Agiala.27
NANO-Antivirus Trojan.Win32.Zerber.enwtbq
MicroWorld-eScan Gen:Variant.Agiala.27
Tencent Malware.Win32.Gencirc.10bc0131
Ad-Aware Gen:Variant.Agiala.27
Sophos Mal/Generic-S + Mal/Elenoocka-E
Comodo TrojWare.Win32.TrojanDropper.Evotob.A@70f09z
F-Secure Heuristic.HEUR/AGEN.1116792
BitDefenderTheta Gen:NN.ZexaF.34790.rqX@aiaDT3
VIPRE Trojan.Win32.Generic!BT
TrendMicro Ransom_CERBER.SM38
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
FireEye Generic.mg.7961a8814d08fd3c
Emsisoft Gen:Variant.Agiala.27 (B)
SentinelOne Static AI – Malicious PE
Jiangmin Trojan.Zerber.bqp
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1116792
eGambit Unsafe.AI_Score_99%
Antiy-AVL Trojan/Generic.ASMalwS.1FEF70E
Microsoft Ransom:Win32/Cerber.J
Arcabit Trojan.Agiala.27
ZoneAlarm Trojan-Ransom.Win32.Zerber.ftzp
GData Gen:Variant.Agiala.27
AhnLab-V3 Trojan/Win32.Cerber.R213396
Acronis suspicious
McAfee Ransomware-FMEU!7961A8814D08
MAX malware (ai score=86)
VBA32 Hoax.Zerber
Malwarebytes Cerber.Ransom.Encrypt.DDS
Panda Trj/Genetic.gen
TrendMicro-HouseCall Ransom_CERBER.SM38
Rising Trojan.Kryptik!1.ABE3 (CLASSIC)
Yandex Trojan.GenAsa!WafdDdY7148
Ikarus Trojan.Crypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.FSHI!tr
AVG Win32:Malware-gen
Paloalto generic.ml
Qihoo-360 Win32/Ransom.Cerber.HxQBWGcA

How to remove Trojan-Ransom.Win32.Zerber.ftzp?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

NSIS/Injector.CMO removal guide

The NSIS/Injector.CMO is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Trojan.Generic.35762198 malicious file

The Trojan.Generic.35762198 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Should I remove “Malware.AI.103442785”?

The Malware.AI.103442785 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Barys.438451 malicious file

The Barys.438451 is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

How to remove “Trojan.Generic.35785663”?

The Trojan.Generic.35785663 is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

Virus:Win32/Memery.HNS!MTB removal tips

The Virus:Win32/Memery.HNS!MTB is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago