Categories: Malware

Barys.323380 (file analysis)

The Barys.323380 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.323380 virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with Confuser
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Barys.323380?


File Info:
name: 92E026403D35F4E6FD42.mlwpath: /opt/CAPEv2/storage/binaries/9fabad3b67a20d7c4ccb01ea05b9b589566867cae513289f66f2ac9c3c95fa8acrc32: 03D8DD5Emd5: 92e026403d35f4e6fd426fefc3cfd89bsha1: 7476eeb5053e06be084967c4333150bea8a38893sha256: 9fabad3b67a20d7c4ccb01ea05b9b589566867cae513289f66f2ac9c3c95fa8asha512: 43769a64816f958ed115ebb76684335e7fabc9f1cb9a4123ce67f60e1c5544a4be51a8f6cba8370a49e78e9fcf387ed04cfb9449715f15cbc4929fff7ccd6951ssdeep: 3072:jUvHQaCtDYml6yrPO4HG633NY485oys9va5NTTAvOUoBti2CbHMc:wvJvmrxHG6n+55s9aEvODWMctype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F514D054BBD49CC6CA1AFEB6548244909A32F91FA137F69364C6E36805A13FBBD0F107sha3_384: ddb901c2c2a5c9dd23c4ee731116ed2b432239b4381e4e9fbae81d8cf8e2ad6ee1f80778d67c45ff232ede9b035c54edep_bytes: ff250020400000000000000000000000timestamp: 2022-09-05 04:35:19
Version Info:
0: [No Data]

Barys.323380 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.323380
FireEye	Generic.mg.92e026403d35f4e6
Malwarebytes	Trojan.MalPack.MSIL
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0059750c1 )
Alibaba	TrojanPSW:MSIL/Agensla.53856223
K7GW	Trojan ( 0059750c1 )
Cybereason	malicious.5053e0
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AFPS
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Gen:Variant.Barys.323380
Avast	PWSX-gen [Trj]
Ad-Aware	Gen:Variant.Barys.323380
DrWeb	Trojan.InjectNET.50
VIPRE	Gen:Variant.Barys.323380
Emsisoft	Gen:Variant.Barys.323380 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Barys.323380
Arcabit	Trojan.Barys.D4EF34
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Trojan/Win.Generic.C5232811
ALYac	Gen:Variant.Barys.323380
MAX	malware (ai score=81)
Rising	Ransom.Blocker!8.12A (TFE:D:Qm8EBsP8WLT)
MaxSecure	Trojan.Malware.121218.susgen
BitDefenderTheta	Gen:NN.ZemsilF.34646.mmY@aiBmMon
AVG	PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (D)