TrojanDownloader:Win32/Berbew!pz malicious file

The TrojanDownloader:Win32/Berbew!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanDownloader:Win32/Berbew!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine TrojanDownloader:Win32/Berbew!pz?


File Info:
name: CA9AC5DD92E4BBDB2728.mlw
path: /opt/CAPEv2/storage/binaries/3f9b159812bb2c71bf0dc70107590380bc23ebc909cd03168386e374650ac193
crc32: 01D2A012
md5: ca9ac5dd92e4bbdb27284c0bd8320386
sha1: a286f355176c6effb8584666fff6d5eea8a4374c
sha256: 3f9b159812bb2c71bf0dc70107590380bc23ebc909cd03168386e374650ac193
sha512: b770f93439dcb3fe409de5603e27fcac8fd2fc8f5bdf05e465fbbc0301f3130652da1e7f6374bda83951aa5c5e64314f42e9b07c4d7ed9b4085fca6a28191a53
ssdeep: 768:sHdYT0AsUViyvGeO8ekec5g/2jXAst/G6Ns5kP/j3wBSX6Yodj/1H5l:ge3iye8fLw2jXArVkTwBSX9of/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T163146CE722466D15C0A11D3F10B214748AD5BF7BA7C5B48AC97B6CBE261728EDAFF040
sha3_384: 54aca7eca3884b9777a2a9c500d0233ad052f984ab4a9c8571abc09eb9cd6dd535274c1bd6f94a01a2ba20ee047ea7b3
ep_bytes: 00000000000000000000000000000000
timestamp: 2023-07-29 18:29:59

Version Info:
0: [No Data]

TrojanDownloader:Win32/Berbew!pz also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
FireEye	Generic.mg.ca9ac5dd92e4bbdb
Skyhigh	BehavesLike.Win32.RAHack.cz
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Trojan-Spy.Quart.a
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Generickdz-10013340-0
Kaspersky	HEUR:Trojan.Win32.Convagent.gen
Avast	Win32:Evo-gen [Trj]
F-Secure	Trojan.TR/Spy.Qukart.NB
DrWeb	BackDoor.HangUp.46592
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
Ikarus	Trojan-Downloader.Win32.Berbew
Varist	W32/Kryptik.DQV.gen!Eldorado
Avira	TR/Spy.Qukart.NB
Xcitium	Worm.Win32.Qukart.K@565w5t
Microsoft	TrojanDownloader:Win32/Berbew!pz
ZoneAlarm	HEUR:Trojan.Win32.Convagent.gen
GData	Win32.Trojan.Agent.0KW0JC
Google	Detected
Acronis	suspicious
McAfee	Artemis!CA9AC5DD92E4
Cylance	unsafe
Zoner	Probably Heur.ExeHeaderL
Rising	Backdoor.Berbew!1.AE0A (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Virus.Mabezat.Dam
Fortinet	W32/Qukart.NB!tr
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.5176c6
DeepInstinct	MALICIOUS

How to remove TrojanDownloader:Win32/Berbew!pz?

TrojanDownloader:Win32/Berbew!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X