Categories: Malware

Barys.244 (B) removal

The Barys.244 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.244 (B) virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Checks for the presence of known windows from debuggers and forensic tools
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Attempts to interact with an Alternate Data Stream (ADS)

How to determine Barys.244 (B)?


File Info:
name: 93394D68BB356A0E5F6A.mlwpath: /opt/CAPEv2/storage/binaries/f86ba839bd0404d8c5bb314cc859c06034a0798563e99292a612c08a0c29cfe2crc32: E6AA7DF4md5: 93394d68bb356a0e5f6a99eeed4000d7sha1: b00228891188582c692de58b282cc57cf2464081sha256: f86ba839bd0404d8c5bb314cc859c06034a0798563e99292a612c08a0c29cfe2sha512: 5256b6bbef11b7901c03d93d811160bdb7f0f1aceda502638cada7002952e69a0105cc271d63ac1c681236535217aceefc40c91b343e78578ae5939a96f8c737ssdeep: 6144:c5KL9R/OYrxWTdPDchAEuGOeXGcYJP+a1IGGLsd5bKNDBiS4sbjdx+T:cML9R/OnBYSpmXGcYJPN1IGGgdQfL6Ttype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1377423FD2F074D8FF23B473903AA8EC7DB8525CC5109BD26460C84AA66B60B1CD97667sha3_384: fc01f568884f71f0ac431d6af9b8105c55c08e2edd8800be49bed331263dc56d5866b48e2430aa6bd0cc9e75b3525e91ep_bytes: 6a286870204000e87402000033ff57fftimestamp: 2009-12-18 19:48:31
Version Info:
FileDescription: Protected ApplicationFileVersion: 1, 0, 0, 1ProductVersion: 1, 0, 0, 1Comments: Is protected with Teggo MoleBox 4.2321Translation: 0x0000 0x04b0

Barys.244 (B) also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Refroso.muCm
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Barys.244
ClamAV	Win.Trojan.Barys-6957974-0
CAT-QuickHeal	VirTool.DelfInject.AF
ALYac	Gen:Variant.Barys.244
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 001788e91 )
Alibaba	TrojanPSW:Win32/Dybalom.9503333b
K7GW	Trojan ( 001788e91 )
CrowdStrike	win/malicious_confidence_100% (D)
Cyren	W32/VBInject.V.gen!Eldorado
Symantec	Backdoor.Bifrose!gen
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.MoleboxUltra suspicious
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan-PSW.Win32.Dybalom.bkn
BitDefender	Gen:Variant.Barys.244
NANO-Antivirus	Trojan.Win32.Dybalom.dwahq
SUPERAntiSpyware	Trojan.Agent/Gen-BigMole
Avast	Win32:Evo-gen [Trj]
Ad-Aware	Gen:Variant.Barys.244
Emsisoft	Gen:Variant.Barys.244 (B)
Comodo	Backdoor.Win32.Curioso.~dy02@1xq8fq
DrWeb	Trojan.PWS.Dybalom
VIPRE	Gen:Variant.Barys.244
TrendMicro	TROJ_BRDLAB.SMEP
McAfee-GW-Edition	GenericRXAA-WT!93394D68BB35
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.93394d68bb356a0e
Sophos	ML/PE-A + Mal/BigMole-B
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Barys.244
Jiangmin	Trojan/PSW.Dybalom.bsx
Webroot	Worm:Win32/Rebhip.A
Avira	TR/Crypt.CFI.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASBOL.C615
Arcabit	Trojan.Barys.244
ViRobot	Trojan.Win32.A.PSW-Dybalom.348360.AJ
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Trojan/Win32.Bifrose.R1707
Acronis	suspicious
McAfee	GenericRXAA-WT!93394D68BB35
VBA32	BScope.Trojan.Inject
Malwarebytes	Trojan.MalPack.Generic
TrendMicro-HouseCall	TROJ_BRDLAB.SMEP
Rising	Trojan.Generic@AI.100 (RDMK:UyKXEQZv3sYz8bUljh0xhg)
Yandex	Trojan.GenAsa!XMiXPNBz8gY
Ikarus	Trojan-PWS.Win32.Dybalom
MaxSecure	Packed.Rebhip.a
Fortinet	W32/Refroso.BKBI!tr
BitDefenderTheta	Gen:NN.ZexaF.34698.vq1@auWmS4b
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.8bb356
Panda	Trj/CI.A