About “Barys.60616” infection

The Barys.60616 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.60616 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Anomalous binary characteristics

How to determine Barys.60616?

File Info:
name: D32D9B29DE08915260B2.mlw
path: /opt/CAPEv2/storage/binaries/cfe18ef6fdb0601083a732b4a86b0237f364d9148fb3a900115c2eeb7904d3ae
crc32: 842E8470
md5: d32d9b29de08915260b2f7de97c54f95
sha1: 279d09a5de7dadb08acef207157efc66930a6a4b
sha256: cfe18ef6fdb0601083a732b4a86b0237f364d9148fb3a900115c2eeb7904d3ae
sha512: db891f65f8055f86f92cd54fa984bd01ced04d4f5d05579014fecde8090ed097570355655688749f14941d0c8cf3a4e001b540618b45804b46a4c2b027f020c0
ssdeep: 6144:uXGOes3rbxG2DN/I+UcwG3qTX3VbKjiK3g2oL8MCfCkbYcTlYBaZBUpBcJAnShiQ:3Up3/BqTniI2rWzBas8JAShiMj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16B346F2FE3122E9AD455C17CC4E2E192144E18EBAF4F8F0B87E967C9135C046B69BD1E
sha3_384: b95c72025b43f24987d9f7038b9e78470ee236070725f615dba4b3e9e994ad116812c88cefa61610610b37d20014a902
ep_bytes: 68f0194000e8f0ffffff000000000000
timestamp: 2011-08-30 09:29:41

Version Info:
Translation: 0x0409 0x04b0
Comments: LrABzEpiqThgwAC
CompanyName: adsNOYidGVpIc
FileDescription: lSkVaAomgyvRoMR
LegalCopyright: qhuFonbMoK
ProductName: LVqEreEbaC
FileVersion: 1.00
ProductVersion: 1.00
InternalName: video
OriginalFilename: video.exe

Barys.60616 also known as:

How to remove Barys.60616?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.