Barys.325924 removal tips

The Barys.325924 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.325924 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• A potential decoy document was displayed to the user
• Creates a copy of itself
• Creates known Njrat/Bladabindi RAT registry keys

How to determine Barys.325924?

File Info:
name: 8A8BD7E77C5AA82BE4B8.mlw
path: /opt/CAPEv2/storage/binaries/abd1e9bb910f2ee576bee960267e3c67fc215907909308d9cd415f3bf3cd8d8c
crc32: B96427BC
md5: 8a8bd7e77c5aa82be4b8b574b0a2d1ef
sha1: e261f52506982ba6dd1a771d147aae54031371d0
sha256: abd1e9bb910f2ee576bee960267e3c67fc215907909308d9cd415f3bf3cd8d8c
sha512: 53b70c17e52da9df061bb2032ee76aab3ca216662afeba1dd6ecdcf68b3c9877d13dfc3f6b23da699247aa27990cc93328e3cd1ed71240a1fa5e506984c28ef2
ssdeep: 3072:pNveU9Y53sLYwx5/lfzReYoYYlGQ4Dnhf1puAOq3gHmY:pEVGRvh1eflGt7pu/R
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D4F3F9AB7584CF14EE581971C4DF983003D2EA871B72E7493F4D26A92E413F25E49BCA
sha3_384: 641b4e7e7c75b917cbe42b346741eae2ccdfefec6a4852d5d40597dedcf4b4b8956c73d9d9661079404fbb021d7f2250
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-07-29 17:49:47

Version Info:
0: [No Data]

Barys.325924 also known as:

How to remove Barys.325924?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.