About “Backdoor:Win32/Berbew!pz” infection

The Backdoor:Win32/Berbew!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Berbew!pz virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Creates an indicator observed in Territorial Disputes report SIG40
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Berbew!pz?

File Info:
name: 8BFC22D44A1B800895D0.mlw
path: /opt/CAPEv2/storage/binaries/ce61d5cbc630e99932fabad967105cd5bd91260955e6d24e52e8fc004c74226c
crc32: 6B6E77E6
md5: 8bfc22d44a1b800895d0e527d9694531
sha1: 30a092bd76484c180d95e464334a42e28ecbea2c
sha256: ce61d5cbc630e99932fabad967105cd5bd91260955e6d24e52e8fc004c74226c
sha512: 0693589a30dd7aeb2f13e47710e8340707ff5af08bd9761bf8286ea23ea2424dca4933a1f30578109d8739f53eee5f48702ae095711422fe3da7c24c64261b8d
ssdeep: 3072:Nee2ry0ByUWwO641drOujQlZDit4Sp+7H7wWkqrifbdB7dYk1Bx8DpsV6OzrCIws:NeL+OqwO641drslNitBOHhkym/89bKws
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18314596A97F40F96F6B5027396059344F78D033AEEAF8727CA44520CF1DEA1783E9A50
sha3_384: 81e14e216525a8793a57b42e2f30248155fa3759620f770e108a31e67c42ebf3062748c1cd65c1a8bc04757325106d3e
ep_bytes: 90b8001040009090bb38de4000b92d70
timestamp: 1987-08-01 05:39:38

Version Info:
0: [No Data]

Backdoor:Win32/Berbew!pz also known as:

How to remove Backdoor:Win32/Berbew!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.