Cerber Ransomware Encrypt Files And Speaks To Victims

What Is Cerber Ransom

Recently a talking Cerber Ransomware has been developed and launched as a service by ulterior Russian forum. Means to say it is a kind of Ransomware as a service (RaaS), provided to the third parties to distribute the ransomware. Whereas the developers earn revenue from their clients on every payment of ransom amount. It is a new kind of ransomwere which can speak to inform victims that files on their computer have been encrypted. Cerber Ransomware uses AES – 256 file encryption algorithm and add .CERBER extension with unique set of string for each victim.

Likewise Lockey ransomware, Cerber Ransomwere also run a scan all drives, network shares and unmapped shares. After a complete scan it encrypts all type of files for users concern. It does not encrypts system files but make changes on them. It make changes on start-up log, MBR and some registry entries "%AppData%\{2ED2A2FE-872C-D4A0-17AC-E301404F1CBA}\[random].exe" to configure Windows computer system to boot automatically in safe mode with networking enabled and also launch itself with every system reboot. When the user power on and log-in the machine, then find a screen saver as a ransom note by Cerber. It also display a scary but fake warning and start rebooting process. On the second reboot, Windows starts in normal mode, the ransomware configure settings file, run itself and start encrypting files.

Files Made by Cerber Ransomware

  • HKCU\Control Panel\Desktop\SCRNSAVE.EXE "%AppData%\{2ED2A2FE-872C-D4A0-17AC-E301404F1CBA}\[random].exe"
  • HKCU\Software\Microsoft\Command Processor\AutoRun "%AppData%\{2ED2A2FE-872C-D4A0-17AC-E301404F1CBA}\[random].exe"
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "%AppData%\{2ED2A2FE-872C-D4A0-17AC-E301404F1CBA}\[random].exe"
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\[random] "%AppData%\{2ED2A2FE-872C-D4A0-17AC-E301404F1CBA}\[random].exe"
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\[random] "%AppData%\{2ED2A2FE-872C-D4A0-17AC-E301404F1CBA}\[random].exe"

After complition of file encryption, it make three ransom note –  # DECRYPT MY FILES #.txt, # DECRYPT MY FILES #.html, # and DECRYPT MY FILES #.vbs. The user find these noted on the desktop and every folder where files has been encrpted. # DECRYPT MY FILES #.vbs is a Visual basic script which is build to speak users on computer about file encryption. These notes also contains full details to pay around $500 within seven days and double the amount for next seven days. Cerber ransom note also include decrypttozxybarc.onion and Tor site Cerber Decryptor links to make payment for retrieve software and keys to decrypt files.

Files Encrypted By Cerber Ransomware

.oab, .ods, .pdf, .pps, .ppsm, .ppt, .pptm, .prf, .pst, .contact, .dbx, .doc, .docx, .jnt, .jpg, .mapimail, .msg, .rar, .rtf, .txt, .wab, .xls, .xlsx, .xml, .zip, .1cd, .aspx, .asx, .avi, .bak, .cer, .cfg, .class, .config, .css, .csv, .db, .dds, .dwg, .dxf, .flf, .flv, .html, .3ds, .3g2, .3gp, .7z, .7zip, .accdb, .aoi, .asf, .asp, .idx, .js, .key, .kwm, .laccdb, .ldf, .lit, .m3u, .mbx, .md, .mdf, .mid, .mlb, .mov, .mp3, .mp4, .mpg, .obj, .odt, .pages, .php, .psd, .pwm, .rm, .mpg, .obj, .odt, .pages, .php, .psd, .pwm, .rm, .safe, .sav, .save, .sql, .srt, .swf, .thm, .vob, .wav, .wma, .wmv, .xlsb, .3dm, .aac, .ai, .arw, .c, .cdr, .cls, .cpi, .cpp, .cs, .db3, .docm, .dot, .dotm, .dotx, .drw, .dxb, .eps, .fla, .flac, .fxg, .java, .m, .m4v, .max, .mdb, .pcd, .pct, .pl, .potm, .potx, .ppam, .ppsm, .ppsx, .pptm, .ps, .pspimage, .r3d, .rw2, .sldm, .sldx, .svg, .tga, .wps, .xla, .xlam, .xlm, .xlr, .xlsm, .xlt, .xltm, .xltx, .xlw, .act, .adp, .al, .bkp, .blend, .cdf, .cdx, .cgm, .cr2, .crt, .dac, .dbf, .dcr, .ddd, .design, .dtd, .fdb, .fff, .fpx, .h, .iif, .indd, .jpeg, .mos, .nd, .nsd, .nsf, .nsg, .nsh, .odc, .odp, .oil, .pas, .pat, .pef, .pfx, .ptx, .qbb, .qbm, .sas7bdat, .say, .st4, .st6, .stc, .sxc, .sxw, .tlg, .wad, .xlk, .aiff, .bin, .bmp, .cmt, .dat, .dit, .edb, .flvv, .gif, .groups, .hdd, .hpp, .log, .m2ts, .m4p, .mkv, .mpeg, .ndf, .nvram, .ogg, .ost, .pab, .pdb, .pif, .png, .qed, .qcow, .qcow2, .rvt, .st7, .stm, .vbox, .vdi, .vhd, .vhdx, .vmdk, .vmsd, .vmx, .vmxf, .3fr, .3pr, .ab4, .accde, .accdr, .accdt, .ach, .acr, .adb, .ads, .agdl, .ait, .apj, .asm, .awg, .back, .backup, .backupdb, .bank, .bay, .bdb, .bgt, .bik, .bpw, .cdr3, .cdr4, .cdr5, .cdr6, .cdrw, .ce1, .ce2, .cib, .craw, .crw, .csh, .csl, .db_journal, .dc2, .dcs, .ddoc, .ddrw, .der, .des, .dgc, .djvu, .dng, .drf, .dxg, .eml, .erbsql, .erf, .exf, .ffd, .fh, .fhd, .gray, .grey, .gry, .hbk, .ibank, .ibd, .ibz, .iiq, .incpas, .jpe, .kc2, .kdbx, .kdc, .kpdx, .lua, .mdc, .mef, .mfw, .mmw, .mny, .moneywell, .mrw, .myd, .ndd, .nef, .nk2, .nop, .nrw, .ns2, .ns3, .ns4, .nwb, .nx2, .nxl, .nyf, .odb, .odf, .odg, .odm, .orf, .otg, .oth, .otp, .ots, .ott, .p12, .p7b, .p7c, .pdd, .pem, .plus_muhd, .plc, .pot, .pptx, .psafe3, .py, .qba, .qbr, .wpd, .x11, .x3f, .xis, .ycbcra, .yuv, .qbw, .qbx, .qby, .raf, .rat, .raw, .rdb, .rwl, .rwz, .s3db, .sd0, .sda, .sdf, .sqlite, .sqlite3, .sqlitedb, .sr2, .srf, .srw, .st5, .st8, .std, .sti, .stw, .stx, .sxd, .sxg, .sxi, .sxm, .tex, .wallet, .wb2,

How To Remove Cerber Ransomware

At very first run on any targeted computer, Cerber Ransomware check the location of computer system whether located in – Azerbaijan, Armenia, Belarus, Kyrgyzstan, Georgia, Kazakhstan, Russia, Moldova, Turkmenistan, Tajikistan, Uzbekistan, Ukraine. In these condition it run termination process for itself otherwise it get installed in the Appdata folder as a name of which starts with Windows executable file. The user get extremely disappointed with sudden file encryption and speaking notification “Attention! Attention!, Attention! Your documents, photos, database and other important files have been encrypted. On text or HTML Cerber Ransom note the victim can see a Latin quote which means "That which does not kill me makes me stronger". So further we will discuss how to kill Cerber Ransomware.


Remove Cerber Ransomware From Your PC

Step 1: Remove Cerber Ransomware in Safe Mode with Command Prompt

  • First of all disconnect your PC with network connection.
  • Click restart button and keep pressing F8 key regularly while system restart.


  • You will see “Windows Advanced Options Menu” on your computer screen.

Windows Advanced Options Menu

  • Select “Safe Mode with Command Prompt” and press Enter key.

safe mode with command promt

  • You must login your computer with Administrator account for full privilege.


  • Once the Command Prompt appears then type rstrui.exe and press Enter


  • Now follow the prompts on your screen to complete system restore.

Step 2: Remove Cerber Ransomware using MSConfig in Safe Mode:

  • Power off your computer and restart again.
  • While booting press the “F8 key” continuously to open “Windows Advanced Options Menu”.


  • Use the arrow keys to select “Safe Mode” option and press Enter key.

Safe mode

  • Once system get started go to Start menu. Type “msconfig” in the search box and launch the application.


  • Go to the Startup tab and look for files from %AppData% or %Temp% folders using rundll32.exe. See an example below:

C:\Windows\System32\rundll32.exe C:\Users\username\appdata\local\temp\regepqzf.dll,H1N1

  • Disable all the malicious entries and save the changes.
  • Now restart your computer normally.

Step 3 : Kill Malicious Process Related To Cerber Ransomware

  • Press Alt+Ctrl+Del buttons together.


  • It will open the Task manager on your screen.
  • Go to Process Tab and find Cerber Ransomware related process.
  • Click the End Process Now button to stop the running process.

Step 4 : Remove Cerber Ransomware Virus From Registry Entry

  • Press “Windows + R” key together to open Run Box.


  • Type “regedit” and click OK button.


  • Find and remove Cerber Ransomware related entries.












Now hopefully you have completely removed the Cerber Ransomware virus from your computer. If you are still get ransom message from the threat or unable to access your files, then it means that virus still remain into your computer. In such situation you don’t have any other option except removing this virus using any powerful malware removal tool.

Whereas if you have any backup of your infected or encrypted files, then you can also reinstall your Windows OS. This will erase all your files and data as along with the Cerber Ransomware infection. You will get a completely empty computer system with no files. Now you can use your backup to get your files. If you don’t have any backup then using malware removal tool is a better option for you.


If you have any query or question regarding your computer, then you can easily ask your problem to our experts. Go to the Ask Any Question page and get the answer for your query directly from out experts.