About “TrojanDownloader:Win32/Berbew!pz” infection

The TrojanDownloader:Win32/Berbew!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanDownloader:Win32/Berbew!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine TrojanDownloader:Win32/Berbew!pz?


File Info:
name: 9C27238FA44D44A61157.mlw
path: /opt/CAPEv2/storage/binaries/dad0c4d965764f1547abea92ebcd037740818d6f550e5eb1e20a27db75c5708c
crc32: 0F187374
md5: 9c27238fa44d44a6115765803ab6c306
sha1: 393c67e623c7bcacfe750af6c0faa16e2457d039
sha256: dad0c4d965764f1547abea92ebcd037740818d6f550e5eb1e20a27db75c5708c
sha512: 07f0943220142336693c09bca80e88eec77d0a0286f3412f1e8177773b80555ba5d1fbe4bdb07112d699b2a3415ac00ab8846934d314255d76ce013780b1ab4d
ssdeep: 768:XqU87jZ/2hYISJesa1T6RFjXUJU5cRC/KlTt/GGJvvH4CGpv44F/1H59:XqUZmVJoN6RFjky/KlgIvQzVj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T192145A83F94E6249F91F50B26CE61EEF5B60DA2FAF94123907915CB4AB493EFD201407
sha3_384: e9ce9619a5f6c9e29c7f2830b476b4984c86e917f4fa7b2121cb8d9a3d87442c3a388117993269221a4d55563f997efa
ep_bytes: 00000000000000000000000000000000
timestamp: 2023-07-29 18:29:59

Version Info:
0: [No Data]

TrojanDownloader:Win32/Berbew!pz also known as:

Bkav	W32.AIDetectMalware
Skyhigh	BehavesLike.Win32.Generic.cz
McAfee	GenericRXAA-FA!9C27238FA44D
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.623c7b
Baidu	Win32.Trojan-Spy.Quart.a
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Qukart-6838239-0
Kaspersky	HEUR:Trojan-Proxy.Win32.Convagent.gen
Avast	Win32:TrojanX-gen [Trj]
Sophos	ML/PE-A
F-Secure	Trojan.TR/Spy.Qukart.NB
DrWeb	BackDoor.HangUp.46592
TrendMicro	TROJ_GEN.R03BC0DAQ24
FireEye	Generic.mg.9c27238fa44d44a6
SentinelOne	Static AI – Malicious PE
Varist	W32/Kryptik.DQV.gen!Eldorado
Avira	TR/Spy.Qukart.NB
Kingsoft	malware.kb.a.1000
Xcitium	Worm.Win32.Qukart.K@565w5t
Microsoft	TrojanDownloader:Win32/Berbew!pz
ZoneAlarm	HEUR:Trojan-Proxy.Win32.Convagent.gen
GData	Win32.Trojan.Agent.HC99SU
Google	Detected
Acronis	suspicious
Cylance	unsafe
Zoner	Probably Heur.ExeHeaderL
TrendMicro-HouseCall	TROJ_GEN.R03BC0DAQ24
Rising	Backdoor.Berbew!1.AE0A (CLASSIC)
Ikarus	Trojan-Spy.Win32
MaxSecure	Virus.Mabezat.Dam
Fortinet	W32/Qukart.NAJ!dam
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove TrojanDownloader:Win32/Berbew!pz?

TrojanDownloader:Win32/Berbew!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X