What is “Barys.23933”?

The Barys.23933 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Barys.23933 virus can do?

CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with SmartAssembly
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Barys.23933?


File Info:
name: 3FA9B673E071968345BD.mlw
path: /opt/CAPEv2/storage/binaries/053871d17bc6957543ea918a75b33f4076b78e074d77208ba49e032ad54dfdc8
crc32: 4E775C53
md5: 3fa9b673e071968345bdb99838b79087
sha1: 2b5ef2fa9bbc71e5d377acd4a901873bc862f685
sha256: 053871d17bc6957543ea918a75b33f4076b78e074d77208ba49e032ad54dfdc8
sha512: 0f9bec8fcc82a3c24a0ccc5e7b8c5fa3e69084771cd878c1055040a02752eeab1ac5ceb72ad48daa73591ae52e14c3a4d257cfad764a8e7253fc7b0e80583e34
ssdeep: 49152:8ebE1L6PGSeKMPXlhUvF4xJjf3eLhoLGmD9:1bEFAGSudhe4xJmLmD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DEC5C50CFBB56E11C62C4377E3A358B882D6A44C2641E34F66993E981F037EDC9DA91D
sha3_384: 629eab98d4bc0c40c36282cb66fa4c5e1059ad9fceb7f3cadbac2bd62e52f30992191946670f8ad1dd5f2af4f2cb1a65
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-11-20 10:49:17

Version Info:
0: [No Data]

Barys.23933 also known as:

Bkav	W32.AIDetectNet.01
Cynet	Malicious (score: 100)
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
K7GW	Trojan ( 700000121 )
Cybereason	malicious.a9bbc7
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Bladabindi.CF
APEX	Malicious
ClamAV	Win.Malware.Zpevdo-9950498-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Barys.23933
MicroWorld-eScan	Gen:Variant.Barys.23933
Avast	Win32:RATX-gen [Trj]
Ad-Aware	Gen:Variant.Barys.23933
Emsisoft	Gen:Variant.Barys.23933 (B)
F-Secure	Heuristic.HEUR/AGEN.1203361
VIPRE	Gen:Variant.Barys.23933
FireEye	Generic.mg.3fa9b673e0719683
Sophos	ML/PE-A + Troj/Bbindi-W
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1203361
Arcabit	Trojan.Barys.D5D7D
GData	Gen:Variant.Barys.23933
Google	Detected
Acronis	suspicious
ALYac	Gen:Variant.Barys.23933
MAX	malware (ai score=84)
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:lAQmWX7qkikO254mtJ/pHw)
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.34796.KoW@aaCBBvf
AVG	Win32:RATX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Barys.23933?

Barys.23933 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X