Categories: Malware

Barys.325609 removal guide

The Barys.325609 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.325609 virus can do?

Behavioural detection: Executable code extraction – unpacking
Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Sample contains Overlay data
Presents an Authenticode digital signature
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities to create a scheduled task
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)

How to determine Barys.325609?


File Info:
name: 7573CE51BD178AF90A61.mlwpath: /opt/CAPEv2/storage/binaries/dc6ac83ea8ee6dbf790c7dd04627dff3b468b2eaa28535ab0e4000a8fcd26e9bcrc32: 28EB21D7md5: 7573ce51bd178af90a613f1352c1f2fasha1: 2e04bb0445a48ccee219f8825505479b9957ed4asha256: dc6ac83ea8ee6dbf790c7dd04627dff3b468b2eaa28535ab0e4000a8fcd26e9bsha512: b070bda11b3a14fbf5c2f1a8c8532479435aae1cbcd2c53ccc01db07abbd1c72505c7d9c1196b48483a41b384b4066cbe4da04384d4131632d2f8e7bfa6b3eb3ssdeep: 49152:N00jhGOFiGnyQXzW2wg9ppU8uXe1lKU/MGbEZQb8TjFJspDLoVMgdkm:rjf3nyAy2wg94NXe3ChQbSFJspDLOMgNtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14DE51202B780CC71F61F857495D49638BE3339212BF2894B2EB8C53D1EB1B87EA71665sha3_384: a14011af00ac142c7ef024cffdbe4e1faeb84034efefa4b04975819ec7b15cb2fc4b55ebd41a6d4e6b8872c149fe2404ep_bytes: 558bec6aff68f8204000685018400064timestamp: 2012-08-29 06:22:26
Version Info:
Comments: This installation was built with Inno Setup.CompanyName: Moxa Inc.                                                   FileDescription: MOXA Smartio/Industio Windows Driver                        FileVersion: 3.0                 LegalCopyright: Moxa Inc.                                                                                           ProductName: MOXA Smartio/Industio Windows Driver                        ProductVersion: 3.0                 Translation: 0x0000 0x04b0

Barys.325609 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.325609
FireEye	Generic.mg.7573ce51bd178af9
CAT-QuickHeal	TrojanToga.MUE.R9
McAfee	PWSZbot-FIB!7573CE51BD17
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 003dc1641 )
K7GW	Trojan ( 003dc1641 )
Cybereason	malicious.1bd178
Symantec	W32.Faedevour!inf
ESET-NOD32	a variant of Win32/TrojanDropper.Agent.PYF
APEX	Malicious
ClamAV	Win.Malware.Bzub-9969513-0
Kaspersky	Backdoor.Win32.Androm.qxe
BitDefender	Gen:Variant.Barys.325609
NANO-Antivirus	Trojan.Win32.Androm.ctymsi
Avast	Win32:Zbot-THZ [Trj]
Tencent	Backdoor.Win32.Androm.qxe
Emsisoft	Gen:Variant.Barys.325609 (B)
Baidu	Win32.Trojan-Dropper.Injector.f
DrWeb	Trojan.Inject2.58694
VIPRE	Gen:Variant.Barys.325609
McAfee-GW-Edition	PWSZbot-FIB!7573CE51BD17
Trapmine	malicious.moderate.ml.score
Sophos	Troj/Mdrop-JIJ
Ikarus	Backdoor.Win32.Androm
Jiangmin	TrojanDropper.Daws.byh
Google	Detected
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.Androm.qxe
Xcitium	TrojWare.Win32.Toga.PYF@7g9q1h
Arcabit	Trojan.Barys.D4F7E9
ViRobot	Win32.Daws.B
ZoneAlarm	Backdoor.Win32.Androm.qxe
GData	Win32.Trojan.PSE.10YPZ2S
Cynet	Malicious (score: 100)
VBA32	BScope.Trojan.Autoit
ALYac	Gen:Variant.Barys.325609
MAX	malware (ai score=81)
Rising	Dropper.Agent!1.AF79 (CLASSIC)
Yandex	Trojan.GenAsa!zFH4sqyAwHU
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Injector.AQV!tr
AVG	Win32:Zbot-THZ [Trj]
Panda	Trj/Genetic.gen