Backdoor:Win32/Berbew!pz removal guide

The Backdoor:Win32/Berbew!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:Win32/Berbew!pz virus can do?

Creates an indicator observed in Territorial Disputes report SIG40
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Backdoor:Win32/Berbew!pz?


File Info:
name: 2506C9B383E14AA35F06.mlw
path: /opt/CAPEv2/storage/binaries/11824fb97bff472b41b5839515919ba19c09cb220c24f75d3ad7e5f84cfef13f
crc32: 075E45FA
md5: 2506c9b383e14aa35f06bb9ef1f2da06
sha1: 8a46f3ab898b8ab2c775743aa7299492a4de3f9a
sha256: 11824fb97bff472b41b5839515919ba19c09cb220c24f75d3ad7e5f84cfef13f
sha512: 9e980c4c872d0fec5a7bfd0f21126ca324e2a18818ed1de901f6ec87a5769a4b7671f5aa0128e7aafc1e7c2e01c7fe1609549c734f48562b3662902b6ab04b81
ssdeep: 768:dfWOW9EBkj3MBcqgdXO4V5xOgHQPSacfE43pn7YZ/1H525nf1fZMEBFELvkVgFRo:FWO3y3603V5wgHQADE4NCyVso
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T127433A87BEBA4E12FB6F077A490A7783263A543F2383515D5558806A790D3FF52F3A80
sha3_384: fa0a30876e1ea7dd4958551bef6a8358960e10ec378adc43702ee224a1f5bc59db35f880d5b5291e0a8a9b22f4e6d12f
ep_bytes: 90909060909090b8001040006a049090
timestamp: 2023-07-29 18:29:59

Version Info:
0: [No Data]

Backdoor:Win32/Berbew!pz also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	GenPack:Backdoor.Hangup.B
ClamAV	Win.Trojan.Crypted-29
FireEye	Generic.mg.2506c9b383e14aa3
Skyhigh	BehavesLike.Win32.Generic.qh
ALYac	GenPack:Backdoor.Hangup.B
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	GenPack:Backdoor.Hangup.B
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005780dd1 )
K7GW	Trojan ( 005780dd1 )
Cybereason	malicious.b898b8
Arcabit	GenPack:Backdoor.Hangup.B
BitDefenderTheta	AI:Packer.6CDB3E0D1E
VirIT	Worm.Win32.Berbew.G
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.Qukart
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Spy.Win32.Qukart.af
BitDefender	GenPack:Backdoor.Hangup.B
Avast	Win32:TrojanX-gen [Trj]
Tencent	Trojan-Ransom.Win32.Pornoasset.a
Emsisoft	GenPack:Backdoor.Hangup.B (B)
Baidu	Win32.Trojan-Spy.Quart.a
F-Secure	Trojan.TR/Spy.Qukart.NB
DrWeb	BackDoor.HangUp.43832
Trapmine	malicious.high.ml.score
Sophos	Mal/Padodor-A
Ikarus	Trojan.Crypt
Jiangmin	TrojanSpy.Qukart.ii
Google	Detected
Avira	TR/Spy.Qukart.NB
MAX	malware (ai score=87)
Antiy-AVL	Trojan[Proxy]/Win32.Qukart.gen
Kingsoft	malware.kb.a.1000
Microsoft	Backdoor:Win32/Berbew!pz
ZoneAlarm	Trojan-Spy.Win32.Qukart.af
GData	GenPack:Backdoor.Hangup.B
Varist	W32/Qukart.K.gen!Eldorado
AhnLab-V3	Win-Trojan/Berbew.51712
Acronis	suspicious
McAfee	Trojan-FVOJ!2506C9B383E1
TACHYON	Backdoor/W32.Padodor
VBA32	BScope.Backdoor.Berbew
Cylance	unsafe
Panda	Trj/Genetic.gen
Rising	Backdoor.Berbew!1.AE0A (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Qukart.A!tr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Backdoor:Win32/Berbew!pz?

Backdoor:Win32/Berbew!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X