Barys.5500 (file analysis)

The Barys.5500 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.5500 virus can do?

Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Executed a process and injected code into it, probably while unpacking
Likely installs a bootkit via raw harddisk modifications
Deletes its original binary from disk
Attempts to restart the guest VM
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Barys.5500?


File Info:
crc32: 45AAFC0A
md5: 417e896855a5a4f780fbee9a7ef2e2f1
name: 417E896855A5A4F780FBEE9A7EF2E2F1.mlw
sha1: 31761a5829b0e2e6a6fd0a539df81e2517d54925
sha256: 6400c15a9e56fc85daadecb0c06b499d190be4dbb328077d74e77ca808a0426e
sha512: b5e9138127242aa54d4af151ced8c6b0fe603e5660f2f29690b3629b2b51e3fa6541d28564d5366822561e035f16380da24db7b9f12d7d13ba9714730779e152
ssdeep: 1536:xg6/HDhVcLu3sHuzr6prkWEoW6chnlgs89JL/3Ah1iE:xh/jowsHitwcpyrr3k1n
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Copyright 2012 Adobe Systems Inc.
InternalName: Photoshop
FileVersion: 13.0 (13.0 20120315.r.428 2012/03/15:21:00:00)
CompanyName: Adobe Systems, Incorporated
ProductName: Adobe Photoshop CS6
ProductVersion: CS6
FileDescription: Adobe Photoshop CS6
OriginalFilename: Photoshop.exe
Translation: 0x0409 0x04b0

Barys.5500 also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 7000000f1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.MBRlock.30
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Barys.5500
Cylance	Unsafe
Zillya	Trojan.Mbro.Win32.3257
CrowdStrike	win/malicious_confidence_70% (D)
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.855a5a
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/MBRlock.D
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Boot.Mbro.d
BitDefender	Gen:Variant.Barys.5500
NANO-Antivirus	Trojan.Win32.Mbro.snffh
MicroWorld-eScan	Gen:Variant.Barys.5500
Tencent	Win32.Trojan.Mbro.yuw
Ad-Aware	Gen:Variant.Barys.5500
Sophos	Mal/Generic-R + Mal/EncPk-AEM
Comodo	Malware@#8lpeg120innv
BitDefenderTheta	Gen:NN.ZelphiF.34690.dmKfa4ucoKii
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Worm.qc
FireEye	Generic.mg.417e896855a5a4f7
Emsisoft	Gen:Variant.Barys.5500 (B)
Jiangmin	Trojan/MBro.rf
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.2740C7
Microsoft	Ransom:Win32/Genasom
AegisLab	Trojan.Win32.Mbro.j!c
GData	Gen:Variant.Barys.5500
AhnLab-V3	Spyware/Win32.Zbot.R28520
McAfee	Artemis!417E896855A5
MAX	malware (ai score=89)
VBA32	TScope.Trojan.Delf
Panda	Generic Malware
Rising	Trojan.Win32.Generic.135C5157 (C64:YzY0OndBWYequgxO)
Yandex	Trojan.Mbro!XPZnOX338M4
Ikarus	Trojan-Ransom.Gimemo
Fortinet	W32/Injector.ZSE!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Barys.5500?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Barys.5500 (file analysis)