Categories: Malware

How to remove “Barys.318532”?

The Barys.318532 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.318532 virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Creates a copy of itself

How to determine Barys.318532?


File Info:
name: E7E7E0E62BC1C735E31D.mlwpath: /opt/CAPEv2/storage/binaries/408cd2ed407d268e528f7c4e22792978245e41b5ed7e978e24be253e8c8e4fb5crc32: 21E07510md5: e7e7e0e62bc1c735e31da37767587adfsha1: 22c9e8cabd21f5354487736b2764c7b195c1a3absha256: 408cd2ed407d268e528f7c4e22792978245e41b5ed7e978e24be253e8c8e4fb5sha512: 085c482a36eaf76cec1c39e31b72f38c677eb2cec4dcae245ff19021f97613dcbd9c3f69c8be1915ba9145a014112681c39908f607cc9c99278a47fcf97187d8ssdeep: 49152:V296v2/2S2gfeSxwSgLHrziYsBL+pLwRlxSXkI:V296v2/2S2gu381+FmaXkItype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14BD58E50EBCAC0F2CA4621B0187EF739CA696D4D5B249BE33369FE9DA5332C16437149sha3_384: 66667a0e53ae41bff740e4e274be2ee8d3e9e125882dc81c12de545a3484c904bc0cc84dfa8aca50e21b6f9fcd0b439dep_bytes: 558bec6aff68b84b5d0068a03a590064timestamp: 2021-04-22 06:50:00
Version Info:
CompanyName: CHENGDU YIWO Tech Development Co., LtdFileDescription: PolicyManage Dynamic Link LibraryFileVersion: 5.8.0.0InternalName: PolicyManageLegalCopyright: Copyright (C) 2005-2011 CHENGDU YIWO Tech Development Co., Ltd. All rights reserved.OriginalFilename: PolicyManage.exeProductName: PolicyMa Dynamic Link LibraryProductVersion: 5.8.0.0Translation: 0x0804 0x04b0

Barys.318532 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Ekstak.4!c
tehtris	Generic.Malware
DrWeb	Trojan.MulDrop11.28728
MicroWorld-eScan	Gen:Variant.Barys.318532
FireEye	Generic.mg.e7e7e0e62bc1c735
Skyhigh	BehavesLike.Win32.Generic.vh
ALYac	Gen:Variant.Barys.318532
Malwarebytes	Generic.Crypt.Trojan.DDS
Zillya	Trojan.Kryptik.Win32.3092374
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005825821 )
Alibaba	Trojan:Win32/Ekstak.156249f4
K7GW	Trojan ( 005825821 )
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HKHD
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Ekstak.gen
BitDefender	Gen:Variant.Barys.318532
Avast	Win32:AdwareX-gen [Adw]
Tencent	Win32.Trojan.Ekstak.Umhl
Emsisoft	Gen:Variant.Barys.318532 (B)
F-Secure	Heuristic.HEUR/AGEN.1314976
VIPRE	Gen:Variant.Barys.318532
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Varist	W32/Kryptik.DXF.gen!Eldorado
Avira	HEUR/AGEN.1314976
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.Ekstak
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Barys.D4DC44
ZoneAlarm	HEUR:Trojan.Win32.Ekstak.gen
GData	Gen:Variant.Barys.318532
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R415538
McAfee	GenericRXAA-FA!E7E7E0E62BC1
TACHYON	Trojan/W32.Ekstak.2789376.C
VBA32	BScope.Trojan.Ekstak
Cylance	unsafe
Panda	Trj/GdSda.A
Rising	Trojan.Kryptik!1.AA23 (CLASSIC)
Yandex	Trojan.Ekstak!NE6/tesMqe4
Ikarus	Trojan.Win32.Crypt
MaxSecure	Trojan.Malware.73555928.susgen
Fortinet	W32/Kryptik.HATU!tr
AVG	Win32:AdwareX-gen [Adw]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)