Barys.318206 (file analysis)

The Barys.318206 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.318206 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Creates a copy of itself
• Deletes executed files from disk
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Barys.318206?

File Info:
name: D158B8E571155186FD5A.mlw
path: /opt/CAPEv2/storage/binaries/ee1e5289d28844efc5cf2cae7103989d7e53d521868900cb40f7cc4183c44fd7
crc32: 5553C18C
md5: d158b8e571155186fd5a9ba565e39879
sha1: e13fb1153af76560b21a96df90b22583817ded24
sha256: ee1e5289d28844efc5cf2cae7103989d7e53d521868900cb40f7cc4183c44fd7
sha512: de9c5ba044ab925274f41f8c2cd9a481f55e7d5bc8d4bdc776ddb352b9048026cce3916bf88b8f1d656ea51f51ed6546ce81d66662dc644ee072a76766a23ed7
ssdeep: 24576:gJfMKvC5LPitWRSG6JdPkVHXzWZl+3a/ZSTeF+77Lv+f6T8Qnskb2i6OBKaBud5:gJfM8CBNSPdsVQlogqeF+bq4TTo5
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1B165E04E63992557C49BE336DC1D8B374903A8B97B9BDAFA30A131EEB0E13C49D41760
sha3_384: 42f1a34cd0ba6f2b007bd7f8cf503caa30fd90f750418b3cd6bbe2a700006e0649a70381bc63639e5d9f80f77185f9be
ep_bytes: e2c42bffb2adaf78b74ca6e93506ce53
timestamp: 1975-06-24 00:00:00

Version Info:
0: [No Data]

Barys.318206 also known as:

How to remove Barys.318206?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.