Cerber 6 Ransomware

Cerber 6 Ransomware Description

Type: Ransomware

The Cerber family of ransomware is known for its sophistication and its development of cutting- edge threats technology. PC security researchers have noticed a new variant in this family, the Cerber 6 Ransomware, which first appeared in April 2017. The Cerber 6 Ransomware is being delivered in a wide variety of ways and seems to include new encryption methods and attack strategies.

The Threat Presented by a Cerber 6 Ransomware Attack

The members of the Cerber family have been near the top of the charts of most widely disseminated ransomware threats. In fact, threats in this family accounted for more than 85% of ransomware infections in the first quarter of 2017. The Cerber 6 Ransomware and its previous variants have been responsible for generating millions of dollars for its creators around the world. One of the reasons why the Cerber 6 Ransomware has been especially effective in generating revenue is that it is being distributed as a RaaS (Ransomware as a Service) currently, where con artists pay for the rights to distribute the Cerber 6 Ransomware, sharing the profits with the Cerber Ransomware's creators.

The New Features in the Cerber 6 Ransomware

The Cerber 6 Ransomware features new delivery methods and a newly updated encryption method. The Cerber 6 Ransomware also includes new defense mechanisms and obfuscation, which include techniques that allow the Cerber 6 Ransomware to bypass many security programs or to detect when it is running in a sandbox environment or virtual system (both of which may be used by PC security researchers to study these threats.) It is clear that threats in the Cerber family are being updated constantly and, since its appearance in 2016, with new versions in this family adding new features, staying ahead of malware researchers and security software.

The Cerber 6 Ransomware is being delivered to victims using spam email messages currently. The Cerber 6 Ransomware is being delivered in emails that use social engineering to trick computer users into opening a ZIP file attachment, which itself contains a JS, or JavaScript file. This corrupted JavaScript file downloads and installs the Cerber 6 Ransomware on the victim's computer. The Cerber 6 Ransomware uses a time delay that allows it to avoid certain sandbox environments. There are several features in the Cerber 6 Ransomware that have caught the attention of malware researchers. The Cerber 6 Ransomware will terminate file processes that could interfere with its encryption routine. The Cerber 6 Ransomware will use file extensions to avoid certain files during encryption. The Cerber 6 Ransomware can interfere with the Windows Firewall, blocking certain firewalls and interfering with security software and restrictions. The detection and removal of a Cerber 6 Ransomware infection will be more difficult due to this interference. The Cerber 6 Ransomware also can self-destruct if the computer has characteristics of a virtualized environment.

One aspect of the Cerber 6 Ransomware that makes it different from various other ransomware Trojans is that it has avoided the use of the RSA and RC4 encryption algorithms in its attacks, which are the most commonly used in these attacks. The Cerber 6 Ransomware attack favors the Cryptographic Application Programming Interface to carry out its encryption attack.

Protecting Your Computer from the Cerber 6 Ransomware and Similar Trojans

Despite that the Cerber 6 Ransomware includes advanced new features, the way to protect your computer from the Cerber 6 Ransomware remains the same as with the countless other ransomware variants that have preceded it. Having backup copies of your files on an external memory device remains (and will remain) the best protection against ransomware like the Cerber 6 Ransomware. This is because having the ability to restore the affected files from a backup copy undoes the Cerber 6 Ransomware attack completely since the con artists lose any power they have over the victim.

Technical Information

Screenshots & Other Imagery

SpyHunter Detects & Remove Cerber 6 Ransomware

File System Details

Cerber 6 Ransomware creates the following file(s):
# File Name MD5 Detection Count
1 _README_HRZVCO6_.hta 16b5a4fe87e1a3eec470a47a33c6630e 61
2 _README_IAXO29_.hta 57acadeabfc8883af78bbeb9dc2199bf 21
3 _HELP_HELP_HELP_QUCBCBS1_.hta c042f1d91619e9b4f91bf1e1b78fee85 14
4 _HELP_HELP_HELP_RSHI_.hta a46e5f2ce8a20bbb8548959debb9ac0c 10
5 _HELP_HELP_HELP_STOV8H1_.hta 1632ca0953d5499bf251455159a80ea0 6
6 amanda.exe 5d01ac55674af365c67d4579b38fbe75 5
7 _HELP_HELP_HELP_ND8FZ.hta 041ef4b6a12e0b3165172884301b0d1e 5
8 _HELP_HELP_HELP_Z49XU_.hta 243d0fd4f4bee5f11698c20d43b958ff 4
9 _HELP_HELP_HELP_XJ7UC8.hta 4ab1a256a5115d00fa7a3222936ddc03 3
10 _HELP_HELP_HELP_WMB7F1L.hta 9befacccf34d60ad1f141e531ddbba52 3
11 _HELP_HELP_HELP_XFCV_.hta 01ec9e50d17de043a23997d6562293ad 3
12 _HELP_HELP_HELP_2AK4U21_.hta 55790c64ce1ff75647d5cadcadf3876e 3
13 Larry.dll c8345f17fe15861cca78b45414357f6c 2
14 _HELP_HELP_HELP_3NNARI.hta 0ef13a9213c456db231825061eec294c 2
15 _HELP_HELP_HELP_L41VV_.hta c63b4a524713e4c5f3802463cb46dab8 2
16 _READ_THI$_FILE_L81EB65A_.hta 2a6828d2ba37bb97efb4773619b80715 2
17 _HELP_HELP_HELP_KJ2P.hta 6689ad9f43ab19a1ccfad9db6a16b772 1
18 _HELP_HELP_HELP_IGTRU.hta c1ea46e1877d089983a4d9060997b04f 1
19 _HELP_HELP_HELP_5B3HEZ6.hta b10e6f69d0c16008410b5c8cfaae0138 1
20 _HELP_HELP_HELP_8EWN8.hta 6f59455817d32c34ae35aac63043f285 1
21 _HELP_HELP_HELP_2R9I63OS.hta a2daec078c54bb6bc5e96038a1506f2c 1
22 _HELP_HELP_HELP_UYUR4YE.hta bc0c75128b9cbc02c8c053c1155fb6d9 1
23 _HELP_HELP_HELP_CKJ4GL.hta 99d3fc208d3623107cfb18a9069e23bd 1
24 _HELP_HELP_HELP_SUXEZY_.hta 5190e890725bf431ba44001e190c70f5 1
25 _HELP_HELP_HELP_GLP9_.hta 5f7533c663ddb4c0ae4dbbaafb50d491 1
26 _HELP_HELP_HELP_HUUKTW_.hta 0224da72bc3638b351cf509cdfc443c2 1
27 _READ_THI$_FILE_DB3DT9_.hta 7476a75b0680d99f5338b886bc7def62 1
28 wP6fT.exe 731279e3c09f8e52a849c0a9c1043bb5 1
More files

Registry Details

Cerber 6 Ransomware creates the following registry entry or registry entries:
File name without path
# DECRYPT MY FILES #.html
# DECRYPT MY FILES #.url
# DECRYPT MY FILES #.vbs
_README_.hta

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.