Barys.332764 malicious file

The Barys.332764 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Barys.332764 virus can do?

Performs HTTP requests potentially not found in PCAP.
Authenticode signature is invalid
Attempts to modify proxy settings
Touches a file containing cookies, possibly for information gathering

How to determine Barys.332764?


File Info:
name: C90603F57D5A3001F624.mlw
path: /opt/CAPEv2/storage/binaries/93a7ed5d8626d9367d275aac041d4a2b2ec596aefa76526f74c45c13f18692f8
crc32: AAFEF185
md5: c90603f57d5a3001f62447ac6c262bd7
sha1: 137c0dcbcf70b405e1d2952fd9b2882539cdebc9
sha256: 93a7ed5d8626d9367d275aac041d4a2b2ec596aefa76526f74c45c13f18692f8
sha512: 409207e341390e31f6828e2350605da1e91002160fa9d63886fcc727827ce7220fa112db5380dfb46a45380b53fe3d6acdbc2a15a1c915511fcff42ce459f958
ssdeep: 24576:2L4b85GB7rcmOw6RQkoNlR83eRZE9UhtnthvIZhh+vhHhhahh65V7sWefHrxhSh9:2sbpncmnSSZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D1158D42BA8380F2C641153014AB6736DA36DF464F25CBC79798FE787C33591AE3726A
sha3_384: b3425f543a0c7738c9ba34741933a9397c28d238221b3bb270a525e6a8867405d535e75f2ca6a50af5e704b6db1b95b4
ep_bytes: 558bec6aff6850064c006874fe480064
timestamp: 2022-02-26 08:02:23

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Client Server Runtime Process
FileVersion: 10.0.14393.2969 (rs1_release.190503-1820)
InternalName: CSRSS.Exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: CSRSS.Exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.14393.2969
Translation: 0x0409 0x04b0

Barys.332764 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Barys.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Barys.332764
FireEye	Generic.mg.c90603f57d5a3001
ALYac	Gen:Variant.Barys.332764
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.ins
Alibaba	Trojan:Win32/VBKrypt.707a22f6
BitDefenderTheta	Gen:NN.ZexaF.36348.5q0@aG4WWAoi
Cyren	W32/ABRisk.HDYS-9248
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.VBKrypt.gen
BitDefender	Gen:Variant.Barys.332764
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.13bdac40
Emsisoft	Gen:Variant.Barys.332764 (B)
F-Secure	Trojan.TR/Crypt.FKM.Gen
VIPRE	Gen:Variant.Barys.332764
McAfee-GW-Edition	BehavesLike.Win32.Infected.dh
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI – Suspicious PE
GData	Win32.Trojan.PSE.1THOGOA
Google	Detected
Avira	TR/Crypt.FKM.Gen
Antiy-AVL	Trojan/Win32.FlyStudio.a
Xcitium	Worm.Win32.Dropper.RA@1qraug
Arcabit	Trojan.Barys.D513DC
ZoneAlarm	HEUR:Trojan.Win32.VBKrypt.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
McAfee	PUP-XEP-FD
MAX	malware (ai score=89)
Cylance	unsafe
Rising	Trojan.Generic@AI.97 (RDML:/HKt4hhIdbpoJjx6FsWswQ)
Ikarus	Trojan.Win32.MBRlock
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	Riskware/PUP_XEP
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Barys.332764?

Barys.332764 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X