Malware

Barys.432014 (file analysis)

Malware Removal

The Barys.432014 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Barys.432014 virus can do?

  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Executable file is packed/obfuscated with Themida
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Barys.432014?


File Info:

name: 9289EF886397991CD14C.mlw
path: /opt/CAPEv2/storage/binaries/a6a8057d749e0bbff0fff30aee85b56da271d928e438b1b6c2801006b0407f55
crc32: 70E0AEDA
md5: 9289ef886397991cd14c6702a4dded05
sha1: f05cbf069793e19c791c76536aa3032df4bff5fa
sha256: a6a8057d749e0bbff0fff30aee85b56da271d928e438b1b6c2801006b0407f55
sha512: 7a464ed096a12772cf5c84bd996bd349d5dfb2db4cda634c8e334db145b8cf463bf38f9934b2207fbcc1bd46855ca72c8d08def5195ee21ee394052ace58d49c
ssdeep: 98304:1egyB8DGqebL6WqSa63DbYHhrdF1cJ+bpZWZgQiZg8atxYO+eVkeuTQeJasjQ1v:TZwKWofdPwWjDQiSHJVkeu8ew51v
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B466338750806FC3CBB093372D568104822AFD75CE462225B15F7FA6427658EDFF8BA9
sha3_384: 61d2b9a360a1252b911a60dfa9e0231be6ddbfb17395e97c659ee76bb92055ad6daff0d39bae43b621d4a3532199cc9e
ep_bytes: e84b0100005389e3538b73088b7b10fc
timestamp: 2021-10-21 10:04:14

Version Info:

Comments:
CompanyName:
FileDescription: Devfoam Applicatione MFC
FileVersion: 1, 0, 0, 1
InternalName: DevFoam
LegalCopyright: Авторские права (C) 2005
LegalTrademarks:
OriginalFilename: DevFoam.EXE
PrivateBuild:
ProductName: Devfoam Applicatione
ProductVersion: 1, 0, 0, 1
SpecialBuild:
Translation: 0x0019 0x04e3

Barys.432014 also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Generic.4!c
MicroWorld-eScanGen:Variant.Barys.432014
FireEyeGeneric.mg.9289ef886397991c
SkyhighBehavesLike.Win32.Generic.vc
McAfeeArtemis!9289EF886397
MalwarebytesGeneric.Malware/Suspicious
Cybereasonmalicious.69793e
Elasticmalicious (moderate confidence)
APEXMalicious
BitDefenderGen:Variant.Barys.432014
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
EmsisoftGen:Variant.Barys.432014 (B)
VIPREGen:Variant.Barys.432014
Trapminemalicious.moderate.ml.score
SentinelOneStatic AI – Suspicious PE
MAXmalware (ai score=87)
Antiy-AVLGrayWare/Win32.Wacapew
ArcabitTrojan.Barys.D6978E
GDataGen:Variant.Barys.432014
GoogleDetected
ALYacGen:Variant.Barys.432014
Cylanceunsafe
ZonerProbably Heur.ExeHeaderL
TrendMicro-HouseCallTROJ_GEN.R002H09J923
RisingTrojan.Generic@AI.100 (RDML:JV24L2czZBLzdndkGcyTvA)
IkarusTrojan.Win32.Krypt
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_70% (W)

How to remove Barys.432014?

Barys.432014 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment