Categories: Malware

Should I remove “Barys.32572”?

The Barys.32572 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.32572 virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Creates known Njrat/Bladabindi RAT registry keys

How to determine Barys.32572?


File Info:
name: 932FBBEB7FE9A994417E.mlwpath: /opt/CAPEv2/storage/binaries/7256a118217803dea652821dd232e8996e49759302283574e13fca80a0d5712ecrc32: 360DE6D6md5: 932fbbeb7fe9a994417e41240d0177d9sha1: d6165f4bc59dceeb6bcaf873258d8b0f0a664f74sha256: 7256a118217803dea652821dd232e8996e49759302283574e13fca80a0d5712esha512: a2c2a39a2c7c8129e79aa8aceb52c63d8c5345ed54b7355483611778dea7d58a4661e6abc1ea54f6700bc2a64760bfc3f4ccbbfaf911c2f26bff9a8c825100d8ssdeep: 3072:0JG5DqTC8m8BEbhDHrXqqf1eogU+unLuuW+MLblXQV/ZPradB1y7AemOtm8MnX:ZqTC8XChDHmRopnuhjaVVey7Ahhtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13F54190DF5FEFD86C9BCA2B3E32200E981E7D9159B20C57B7EE018542E2526ADCC5794sha3_384: c71a167e0e5006e24823d84addab9c0ded810cabca8c65662ab23c73925cc9e8cf637511619dcf1493494a9c1502710aep_bytes: ff250020400000000000000000000000timestamp: 2015-01-19 20:04:18
Version Info:
Translation: 0x0000 0x04b0Comments: Host Process for Window ServicesFileDescription: Host Process for Window ServicesFileVersion: 1.0.0.0InternalName: svshost.exeLegalCopyright: Copyright ©  2015OriginalFilename: svshost.exeProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Barys.32572 also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.lWou
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.932fbbeb7fe9a994
McAfee	Artemis!932FBBEB7FE9
VIPRE	Gen:Variant.Barys.32572
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 004b93c91 )
Alibaba	Trojan:MSIL/Zapchast.976e5faa
K7GW	Trojan ( 004b93c91 )
Cybereason	malicious.b7fe9a
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.GZB
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.MSIL.Zapchast.ygfb
BitDefender	Gen:Variant.Barys.32572
NANO-Antivirus	Trojan.Win32.Zapchast.dobgsv
MicroWorld-eScan	Gen:Variant.Barys.32572
Avast	Win32:Malware-gen
Rising	Trojan.Generic/MSIL@AI.94 (RDM.MSIL:L84iWAR+KbE4dwqiLksvnQ)
Ad-Aware	Gen:Variant.Barys.32572
Emsisoft	Gen:Variant.Barys.32572 (B)
Comodo	Malware@#30ezvjsspiby5
Zillya	Trojan.Injector.Win32.638403
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-R + Troj/MSIL-HPV
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Barys.32572
Jiangmin	Trojan.MSIL.aghl
Avira	HEUR/AGEN.1216682
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.330C
Arcabit	Trojan.Barys.D7F3C
SUPERAntiSpyware	Trojan.Agent/Gen-Falint
ZoneAlarm	Trojan.MSIL.Zapchast.ygfb
Microsoft	Backdoor:MSIL/Bladabindi
Google	Detected
AhnLab-V3	Win-Trojan/MSILKrypt14.Exp
Acronis	suspicious
ALYac	Gen:Variant.Barys.32572
Cylance	Unsafe
Tencent	Msil.Trojan.Zapchast.Hqlj
Yandex	Trojan.Zapchast!xvj0LeWgTQQ
Ikarus	Trojan.SuspectCRC
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Tfr.EH!tr
BitDefenderTheta	Gen:NN.ZemsilF.34646.rm0@aKyeWll
AVG	Win32:Malware-gen
Panda	Generic Suspicious
CrowdStrike	win/malicious_confidence_100% (W)