Should I remove “Babar.67121”?

The Babar.67121 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Babar.67121 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Deletes its original binary from disk
• Created a process from a suspicious location
• Creates a copy of itself

How to determine Babar.67121?

File Info:
name: DF4B91B86923300C5C42.mlw
path: /opt/CAPEv2/storage/binaries/89373669c271d24427c8d2933c3e0ef4791c60ec501ffdfe6ac5755fe367d633
crc32: A14A4F64
md5: df4b91b86923300c5c425c0bd9f46542
sha1: 96b4bbbe6b6f7eceead2efec90c183cadae9e8a7
sha256: 89373669c271d24427c8d2933c3e0ef4791c60ec501ffdfe6ac5755fe367d633
sha512: 6dcf3fc4bb8278072cefccb9b9700abd53689fc1540309f2ee4838037052f9ea33c07c1929679b393be673feb4ed4e6a414f7d64717465c6107b67d04fbde708
ssdeep: 1536:gqxfBZ9yzhtKIHI/PtrK4Eg9Kc9yBOM6sQdLqmG4Emp3dDxO:g4Z6z4xK4fKJBZ6lNGdYttO
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T10343023DCF471882CDB852F342187EA54766F50A3038DA3497BA2A3FABD074625E64C5
sha3_384: 5c4871dfe4cab0eb431c6263c8e91e6c6cbae7d25ff68be1ae25a7de178edd3ae1dcdddba961a7e41671790a48819354
ep_bytes: 68000000005e5029df5a81c7640f782e
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Babar.67121 also known as:

How to remove Babar.67121?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.