Malware

What is “Barys.44 (B)”?

Malware Removal

The Barys.44 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Barys.44 (B) virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Barys.44 (B)?


File Info:

name: 34B071C933C39FC1BF84.mlw
path: /opt/CAPEv2/storage/binaries/fc8f7364014d52fbd34f6d47bc1fe3b3b3bdb29a28cb5480ed949bd6eb72529a
crc32: FF33B8F3
md5: 34b071c933c39fc1bf8448d5ced51ab5
sha1: 0ba70de1a1b1b2e2fa44d8ad3404b746ab95e80f
sha256: fc8f7364014d52fbd34f6d47bc1fe3b3b3bdb29a28cb5480ed949bd6eb72529a
sha512: eaa0e30e42c5902ea4681f8f0edc935f4d920606bb4beba2ba6c23a21371fa936cb1c8ec95ed65affc8f1997aa9a0ba08fe8e0f8e725afb8c012fb6614cd1f60
ssdeep: 3072:AJc9ElEQ335+L0JnftJDw8/ql8Tn6L3+NprvIQDnv8QjOBEwuu:CEe3ySnffVG+nrv3DLOG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T169F3F1717E80D032D0A991B956E8EF86227A6E1D1371A7C37FE81DCB1B271E01D2536B
sha3_384: 2ba98a05c6c178287623ea9bd2cae52db25951d3f0a0cf19eafb2907803697d3cdc37f69559698010bd5ccc061834938
ep_bytes: 6a6068f8714100e84a080000bf940000
timestamp: 2012-02-15 09:25:11

Version Info:

0: [No Data]

Barys.44 (B) also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Zbot.l!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Barys.44
ClamAVWin.Trojan.Zbot-20413
FireEyeGeneric.mg.34b071c933c39fc1
ALYacGen:Variant.Barys.44
CylanceUnsafe
ZillyaTrojan.Zbot.Win32.54466
SangforSuspicious.Win32.Save.ins
K7AntiVirusSpyware ( 005705391 )
K7GWSpyware ( 005705391 )
Cybereasonmalicious.933c39
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Spy.Zbot.YW
APEXMalicious
CynetMalicious (score: 100)
KasperskyTrojan-Spy.Win32.Zbot.dldt
BitDefenderGen:Variant.Barys.44
NANO-AntivirusTrojan.Win32.Zbot.cwfmti
Ad-AwareGen:Variant.Barys.44
EmsisoftGen:Variant.Barys.44 (B)
ComodoMalware@#13mirr4uhmbk5
DrWebTrojan.PWS.Panda.547
VIPREGen:Variant.Barys.44
McAfee-GW-EditionPWS-Zbot.gen.bcq
Trapminemalicious.high.ml.score
SophosML/PE-A + Mal/Zbot-ES
SentinelOneStatic AI – Malicious PE
JiangminTrojanSpy.Zbot.boui
WebrootW32.Malware.Gen
AviraTR/Crypt.ZPACK.Gen8
MAXmalware (ai score=89)
Antiy-AVLTrojan/Generic.ASMalwS.31
MicrosoftTrojan:Win32/Orsam!rts
ViRobotTrojan.Win32.A.Zbot.167936.BI
GDataGen:Variant.Barys.44
GoogleDetected
McAfeePWS-Zbot.gen.bcq
VBA32TrojanSpy.Zbot
PandaTrj/Genetic.gen
RisingMalware.Undefined!8.C (TFE:5:lrk5IJAZEIE)
YandexTrojan.GenAsa!cKkN5623OYU
IkarusTrojan-Spy.Win32.Zbot
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Generic.AC.313E5!tr
BitDefenderThetaGen:NN.ZexaF.34682.kqW@a8cu3Mo
AVGWin32:Spyware-gen [Spy]
AvastWin32:Spyware-gen [Spy]
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Barys.44 (B)?

Barys.44 (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment