Barys.17983 (B) (file analysis)

The Barys.17983 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.17983 (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Anomalous .NET characteristics
• CAPE detected the njRat malware family
• Creates known Njrat/Bladabindi RAT registry keys

How to determine Barys.17983 (B)?

File Info:
name: F0315E189B5535FFC8E0.mlw
path: /opt/CAPEv2/storage/binaries/688445b18619e5c7f9023e7aadc7b7b1e2cb1302ce730ba642830845928302cf
crc32: 8BB6A0DD
md5: f0315e189b5535ffc8e0ddb783091376
sha1: 6b47b69bd8058d06be2dc26dc713727d11b29428
sha256: 688445b18619e5c7f9023e7aadc7b7b1e2cb1302ce730ba642830845928302cf
sha512: 36b722b4d6493688e80857e1489a3c3f976abb6678181136a2e69e9801b941b17c26a1584db7b00361189a30c3ab65823444c4e0f7fc78400c1775219a99664d
ssdeep: 6144:1ctb5qG/lKPyRulz0ant8LZqPz4auZqPz:6P/l18Xx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T119F407A273ACEC52D7780E3017738BA68B7ADD350862C6091DD4717CAE7E3726D016DA
sha3_384: 18230575497277267b4adb25bf96c076ac8e8d3bc3d8a20c203de1a48f0bb1fa33b5cda6ff57a466fbc7be3df884d6bf
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-02-05 20:46:57

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: Builder.exe
LegalCopyright:  
OriginalFilename: Builder.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Barys.17983 (B) also known as:

How to remove Barys.17983 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.