Categories: Malware

Barys.52453 information

The Barys.52453 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.52453 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Enumerates the modules from a process (may be used to locate base addresses in process injection)
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Authenticode signature is invalid
Anomalous .NET characteristics
Behavioural detection: Injection (inter-process)

How to determine Barys.52453?


File Info:
name: E2485495DECD00D64A72.mlwpath: /opt/CAPEv2/storage/binaries/ddac27f3692ad2ec3c81756e6302a398ed79f8661330452ff5fc123f33103c18crc32: 626E1D28md5: e2485495decd00d64a7285bc5a82fe69sha1: 192dbc83d6eb6ef7059be47d28505e9077020f63sha256: ddac27f3692ad2ec3c81756e6302a398ed79f8661330452ff5fc123f33103c18sha512: 8715c0180e5fa1fff5dd43a310802608020fd216b41da8966678142b7239bfe1eb508203d104b8e5b7823a989bd5696969513a5a8557a126a2f51e241284d914ssdeep: 6144:k+XDL2apKByRiJQAgiiDiM4v8pYX2n3Ho7IKE46kLxABBo/U:VXDL28ctAWM4TX2n39/jkLtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11974CF6B3FAC9143CFCB0BF1DCE61190B6F1D7096253DBD514652AB52A07398A8883DBsha3_384: 1665c33fbb705ff45bd7fbb430b50e0f5c5683e8fea327a7b18c18dcce100fe9ebfc82d8902929570f018de52f68496dep_bytes: ff25008044000b0600d66700000a1038timestamp: 2021-12-11 12:07:05
Version Info:
0: [No Data]

Barys.52453 also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.52453
FireEye	Generic.mg.e2485495decd00d6
ALYac	Gen:Variant.Barys.52453
Cylance	Unsafe
Sangfor	Virus.Win32.Save.a
K7AntiVirus	Trojan ( 7000001c1 )
Alibaba	Trojan:MSIL/VMProtBad.9aaed0c3
K7GW	Trojan ( 7000001c1 )
Cybereason	malicious.5decd0
Baidu	MSIL.Backdoor.Bladabindi.a
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Packed.VMProtect.B
APEX	Malicious
ClamAV	Win.Trojan.Bladabindi-9815414-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Barys.52453
Avast	Win32:MalwareX-gen [Trj]
Tencent	Win32.Trojan.Generic.Ahoa
Ad-Aware	Gen:Variant.Barys.52453
Sophos	ML/PE-A + Mal/VMProtBad-A
TrendMicro	TROJ_GEN.R002C0RLB21
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Gen:Variant.Barys.52453 (B)
Ikarus	Backdoor.MSIL.Bladabindi
GData	Gen:Variant.Barys.52453
Jiangmin	Trojan.Generic.hedqa
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.34E9F82
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Barys.DCCE5
ViRobot	Trojan.Win32.Z.Barys.366592.C
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Generic.C4384675
Acronis	suspicious
McAfee	Artemis!E2485495DECD
MAX	malware (ai score=87)
Malwarebytes	Malware.Heuristic.1003
TrendMicro-HouseCall	TROJ_GEN.R002C0RLB21
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	PossibleThreat
BitDefenderTheta	Gen:NN.ZemsilF.34084.wuW@a8V9vIj
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_90% (W)
MaxSecure	Trojan.Malware.300983.susgen