Cerber2 Ransomware

The Cerber2 Ransomware is the second version of the Cerber Ransomware, an infamous ransomware Trojan responsible for numerous attacks on computers. While files encrypted by the Cerber Ransomware were identified by the '.CERBER' extension, the Cerber2 Ransomware appends the extension '.the Cerber2' to the files it encrypts. There are also various changes to the Cerber2 Ransomware's programming and mode of attack that make it particularly more threatening than its previous version.

The Cerber2 Ransomware may be the First Version of Other Variants

The Cerber2 Ransomware uses a typical encryption ransomware Trojan approach to attacking its victims, encrypting the victims' files and then demanding the payment of a ransom. PC security analysts have associated the Cerber2 Ransomware with a fake icon for a children's computer game known as Anka. While this may be a characteristic particular to one variant of the Cerber2 Ransomware, it is likely that various other variants that use different icons or stop using this particular deception will appear. During its attack, the Cerber2 Ransomware changes the victim's Desktop image into a ransom note. This ransom note, which resembles a pixelated screen, warns the victim that 'Your documents, photos, databases, and other important files have been encrypted!'

The Differences Between the Cerber2 Ransomware and Its Previous Version

There are several particular characteristics that make the Cerber2 Ransomware more threatening than its predecessor. In particular, the Cerber2 Ransomware's developers have removed a vulnerability that had allowed malware researchers to decrypt the files after the Cerber2 Ransomware carried out its encryption attack. The Cerber2 Ransomware also is packed differently and obfuscated in a different way to make it difficult for security software to detect the attack and PC security analysts study how the Cerber2 Ransomware works. The Cerber2 Ransomware now uses CryptGenRandom, a Microsoft API, to generate the encryption. The Cerber2 Ransomware now also generates a 32-byte key instead of a 16-byte key, as in its predecessor, making the previously developed decryption utility useless against the Cerber2 Ransomware.

Analyzing the Cerber2 Ransomware

PC security analysts have studied the Cerber2 Ransomware's configuration files, making it apparent that the Cerber2 Ransomware is designed to avoid sandbox environments by using a variety of methods. The Cerber2 Ransomware is designed to target the following file types:

1cd, .3dm, .3ds, .3fr, .3g2, .3gp, .3pr, .7z, .7zip, .aac, .ab4, .abd, .acc, .accdb, .accde, .accdr, .accdt, .ach, .acr, .act, .adb, .adp, .ads, .agdl, .ai, .aiff, .ait, .al, .aoi, .apj, .apk, .arw, .ascx, .asf, .asm, .asp, .aspx, .asset, .asx, .atb, .avi, .awg, .back, .backup, .backupdb, .bak, .bank, .bay, .bdb, .bgt, .bik, .bin, .bkp, .blend, .bmp, .bpw, .bsa, .c, .cash, .cdb, .cdf, .cdr, .cdr3, .cdr4, .cdr5, .cdr6, .cdrw, .cdx, .ce1, .ce2, .cer, .cfg, .cfn, .cgm, .cib, .class, .cls, .cmt, .config, .contact, .cpi, .cpp, .cr2, .craw, .crt, .crw, .cry, .cs, .csh, .csl, .css, .csv, .d3dbsp, .dac, .das, .dat, .db, .db_journal, .db3, .dbf, .dbx, .dc2, .dcr, .dcs, .ddd, .ddoc, .ddrw, .dds, .def, .der, .des, .design, .dgc, .dgn, .dit, .djvu, .dng, .doc, .docm, .docx, .dot, .dotm, .dotx, .drf, .drw, .dtd, .dwg, .dxb, .dxf, .dxg, .edb, .eml, .eps, .erbsql, .erf, .exf, .fdb, .ffd, .fff, .fh, .fhd, .fla, .flac, .flb, .flf, .flv, .flvv, .forge, .fpx, .fxg, .gbr, .gho, .gif, .gray, .grey, .groups, .gry, .h, .hbk, .hdd, .hpp, .html, .ibank, .ibd, .ibz, .idx, .iif, .iiq, .incpas, .indd, .info, .info_, .ini, .iwi, .jar, .java, .jnt, .jpe, .jpeg, .jpg, .js, .json, .k2p, .kc2, .kdbx, .kdc, .key, .kpdx, .kwm, .laccdb, .lbf, .lck, .ldf, .lit, .litemod, .litesql, .lock, .log, .ltx, .lua, .m, .m2ts, .m3u, .m4a, .m4p, .m4v, .ma, .mab, .mapimail, .max, .mbx, .md, .mdb, .mdc, .mdf, .mef, .mfw, .mid, .mkv, .mlb, .mmw, .mny, .money, .moneywell, .mos, .mov, .mp3, .mp4, .mpeg, .mpg, .mrw, .msf, .msg, .myd, .nd, .ndd, .ndf, .nef, .nk2, .nop, .nrw, .ns2, .ns3, .ns4, .nsd, .nsf, .nsg, .nsh, .nvram, .nwb, .nx2, .nxl, .nyf, .oab, .obj, .odb, .odc, .odf, .odg, .odm, .odp, .ods, .odt, .ogg, .oil, .omg, .one, .orf, .ost, .otg, .oth, .otp, .ots, .ott, .p12, .p7b, .p7c, .pab, .pages, .pas, .pat, .pbf, .pcd, .pct, .pdb, .pdd, .pdf, .pef, .pem, .pfx, .php, .pif, .pl, .plc, .plus_muhd, .pm!, .pm, .pmi, .pmj, .pml, .pmm, .pmo, .pmr, .pnc, .pnd, .png, .pnx, .pot, .potm, .potx, .ppam, .pps, .ppsm, .ppsx,.ppt, .pptm, .pptx, .prf, .private, .ps, .psafe3, .psd, .pspimage, .pst, .ptx, .pub, .pwm, .py, .qba, .qbb, .qbm, .qbr, .qbw, .qbx, .qby, .qcow, .qcow2, .qed, .qtb, .r3d, .raf, .rar, .rat, .raw, .rdb, .re4, .rm, .rtf, .rvt, .rw2, .rwl, .rwz, .s3db, .safe, .sas7bdat, .sav, .save, .say, .sd0, .sda, .sdb, .sdf, .sh, .sldm, .sldx, .slm, .sql, .sqlite, .sqlite3, .sqlitedb, .sqlite-shm, .sqlite-wal, .sr2, .srb, .srf, .srs, .srt, .srw, .st4, .st5, .st6, .st7, .st8, .stc, .std, .sti, .stl, .stm, .stw, .stx, .svg, .swf, .sxc, .sxd, .sxg, .sxi, .sxm, .sxw, .tax, .tbb, .tbk, .tbn, .tex, .tga, .thm, .tif, .tiff, .tlg, .tlx, .txt, .upk, .usr, .vbox, .vdi, .vhd, .vhdx, .vmdk, .vmsd, .vmx, .vmxf, .vob, .vpd, .vsd, .wab, .wad, .wallet, .war, .wav, .wb2, .wma, .wmf, .wmv, .wpd, .wps, .x11, .x3f, .xis, .xla, .xlam, .xlk, .xlm, .xlr, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xps, .xxx, .ycbcra, .yuv, .zip.

As with most ransomware threats, the best protection against these infections is to ensure that a good backup of all files exists. If computer users can recover their files from a backup, then the con artists responsible for ransomware Trojans will lose any hold they have over their victims.

SpyHunter Detects & Remove Cerber2 Ransomware