Backdoor:Win32/Berbew!pz (file analysis)

The Backdoor:Win32/Berbew!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Berbew!pz virus can do?

• Sample contains Overlay data
• Creates an indicator observed in Territorial Disputes report SIG40
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Berbew!pz?

File Info:
name: C78D596A826F9E6B26A9.mlw
path: /opt/CAPEv2/storage/binaries/3feeb7e93147c24b0aece10990794499c8992db5bbf7c4d6c72f43c828f3c8e8
crc32: D88B31B2
md5: c78d596a826f9e6b26a9eadd1db33b96
sha1: 98cd40d5d46c108c896ee8e7bb6612c2465e8a89
sha256: 3feeb7e93147c24b0aece10990794499c8992db5bbf7c4d6c72f43c828f3c8e8
sha512: e2a970cc22c0a5109259553cc210881a8ac9fe571ef00eb7ab30f3ca1647ed800174aee62085cadae43886f1d01865155e7f2c32619579d851f3ccb8c3bb0b07
ssdeep: 3072:pEfUgUQr3Q/4/cyGeAN7DxSvITW/cbFGS92TlTTtttSneicdq:pEf9r324/3dAhhCw92TlTTttt5D
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T148047CEB2ED50F91E8CEC6BE69568CAA7354C2EA3125809C1C74809CC1765F0CDBE977
sha3_384: 0fd6201cb3da2e03dc2d428948137fc5a30d9b2a6f2caf04eee4bab81494fe4b32ea6718f6eb251bce427aa27d9bcd78
ep_bytes: 90906090909090b80010400090bbd0c7
timestamp: 2019-02-27 03:39:59

Version Info:
0: [No Data]

Backdoor:Win32/Berbew!pz also known as:

How to remove Backdoor:Win32/Berbew!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.