Barys.25112 (file analysis)

The Barys.25112 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Barys.25112 virus can do?

CAPE extracted potentially suspicious content
Drops a binary and executes it
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Creates a copy of itself

How to determine Barys.25112?


File Info:
name: A2CA9D1834B973D04482.mlw
path: /opt/CAPEv2/storage/binaries/683604492eeee93f6761261bc49c3d738f2d023845de3bba2664e06c9bd6d3ba
crc32: D9C4EB88
md5: a2ca9d1834b973d044821cefeacd1d55
sha1: 0bd971ede560ca982b230d68b57cd185aef04696
sha256: 683604492eeee93f6761261bc49c3d738f2d023845de3bba2664e06c9bd6d3ba
sha512: 4d99ddac1828d80864118f88581981b01dd8853a0f677f6cb302d90637af942d6e29d8e415195f517403f014fec662eaf77aa941494ebfebb2c0f61912018ae5
ssdeep: 6144:OEmBRk2ZHF29RcsZCtLUNHh1P+I+2MYiguufdFg:OlkoF24sZCtIB1P+V2NfdFg
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14044BE02BE51CA9DC92D8773C9A7D1341F3CAA59E5B2471F1F986A4039A33A7510FC6C
sha3_384: 5232465cda0a276912cfec61f746919b4de8554dfb75243f0f8f26e63f79202283c0662a9041d252ef040ebe8900c235
ep_bytes: ff250020400000000000000000000000
timestamp: 2013-11-13 13:15:12

Version Info:
Translation: 0x0000 0x04b0
Comments: Henvs00ITUr0
CompanyName: BdlrpSSCMMpR
FileDescription: BdlrpSSCMMpR
FileVersion: 4.1.5.0
InternalName: Install.exe
LegalCopyright: BdlrpSSCMMpR
LegalTrademarks: Henvs00ITUr0
OriginalFilename: Install.exe
ProductName: Henvs00ITUr0
ProductVersion: 4.1.5.0
Assembly Version: 4.2.4.5

Barys.25112 also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader7.43630
MicroWorld-eScan	Gen:Variant.Barys.25112
FireEye	Generic.mg.a2ca9d1834b973d0
McAfee	Trojan-FDWX!A2CA9D1834B9
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34698.pm0@aqgOxxd
ESET-NOD32	a variant of MSIL/Injector.CHE
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Barys.25112
Avast	MSIL:GenMalicious-AAP [Trj]
Tencent	Win32.Trojan.Generic.Ugil
Ad-Aware	Gen:Variant.Barys.25112
Emsisoft	Gen:Variant.Barys.25112 (B)
Comodo	Malware@#wiwvqoip4rdq
VIPRE	Gen:Variant.Barys.25112
McAfee-GW-Edition	Trojan-FDWX!A2CA9D1834B9
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Barys.25112
Google	Detected
Avira	TR/Dropper.MSIL.Gen
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Generic.ASMalwS.19D4
Microsoft	Backdoor:MSIL/Bladabindi
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Fsysna.C219228
Acronis	suspicious
ALYac	Gen:Variant.Barys.25112
Cylance	Unsafe
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:tH8VrgXfW4wmkm6QnCNx/g)
Yandex	Trojan.Agent!anCG6vhc1NE
Ikarus	Trojan.MSIL2
Fortinet	MSIL/Injector.CER!tr
AVG	MSIL:GenMalicious-AAP [Trj]
Cybereason	malicious.834b97
Panda	Generic Malware

How to remove Barys.25112?

Barys.25112 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X