Barys.319831 (file analysis)

The Barys.319831 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Barys.319831 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Barys.319831?


File Info:
name: EF62BA8ED8F2465181BF.mlw
path: /opt/CAPEv2/storage/binaries/6af448b731923642af6d1f99b78258e578b2efa4be214f5578079023e2c40203
crc32: E5E0E8B0
md5: ef62ba8ed8f2465181bf70ffae718080
sha1: cdeb228f4bba4036163ca6a9baad0b66bf570aa3
sha256: 6af448b731923642af6d1f99b78258e578b2efa4be214f5578079023e2c40203
sha512: 9557fb26044c168d62dd6f5aa5e30053e518e026a950a51a9f5a3140c8d01b76ce1f02dac76e936c65f11cdea5efb5b58c725515131427827c440c663b21172f
ssdeep: 3072:UcXDhZms32PxiENcYgvvOk5Wb+glu8cW1y5rPws2nghDMIB5OfVK53pa9K/+9ARm:vdZN2EZHOk5WDzyqLVapO9e1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BC642A1BBA658D21C2CC5636E0CB45144FE696867333E70B7A8E13950D033FEAA5E6C7
sha3_384: 804bcd9b67acc891e864f7d10e2d23744b51ced10c2aea14f833bf35071e12f03bb78b8bd83a82baba509ec02dee2424
ep_bytes: ff250020400000000000000000000000
timestamp: 2045-02-28 19:12:17

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: fud
FileVersion: 1.0.0.0
InternalName: fud.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: fud.exe
ProductName: fud
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Barys.319831 also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Ursu.4!c
MicroWorld-eScan	Gen:Variant.Barys.319831
FireEye	Generic.mg.ef62ba8ed8f24651
McAfee	RDN/Generic.dx
Cylance	Unsafe
VIPRE	Gen:Variant.Barys.319831
K7AntiVirus	Trojan ( 0058b7ee1 )
Alibaba	Trojan:Win32/Shelma.14423f84
K7GW	Trojan ( 0058b7ee1 )
Cybereason	malicious.ed8f24
BitDefenderTheta	Gen:NN.ZemsilF.34786.tm0@aOvDt5p
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.ADQX
TrendMicro-HouseCall	TROJ_GEN.R002C0PG722
Paloalto	generic.ml
ClamAV	Win.Packed.Cerbu-9952791-0
Kaspersky	Trojan.Win32.Shelma.ccab
BitDefender	Gen:Variant.Barys.319831
Avast	Win32:CrypterX-gen [Trj]
Tencent	Win32.Trojan.Shelma.Anfm
Ad-Aware	Gen:Variant.Barys.319831
Sophos	Generic ML PUA (PUA)
Zillya	Trojan.Shelma.Win32.13668
TrendMicro	TROJ_GEN.R002C0PG722
McAfee-GW-Edition	RDN/Generic.dx
Emsisoft	Gen:Variant.Barys.319831 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Barys.319831
Avira	TR/Kryptik.flsih
MAX	malware (ai score=86)
Antiy-AVL	Trojan/Generic.ASMalwS.720E
Arcabit	Trojan.Barys.D4E157
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.C4151496
Acronis	suspicious
ALYac	Gen:Variant.Barys.319831
Malwarebytes	Trojan.Crypt
APEX	Malicious
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Malicious_Behavior.SB
AVG	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (W)

How to remove Barys.319831?

Barys.319831 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X