What is “Barys.953”?

The Barys.953 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.953 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• HTTPS urls from behavior.
• Network anomalies occured during the analysis.
• Enumerates running processes
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Attempts to modify proxy settings
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Barys.953?

File Info:
name: C787F41E4BF61F52D2D6.mlw
path: /opt/CAPEv2/storage/binaries/b3f5e004165a73f0ea1af984d0c81ec9cd4d02f22b45d4c170b0dadfac4980b4
crc32: 579321F0
md5: c787f41e4bf61f52d2d6cab47ad1578b
sha1: 07150726d4a349ea3cc3e5f9fabd4a12446d6d2e
sha256: b3f5e004165a73f0ea1af984d0c81ec9cd4d02f22b45d4c170b0dadfac4980b4
sha512: aca47ee5a6eed87a3006288e170782e926f7e9c20d07877bf1dfe6c11db8c817b7314159b95b7068e28c3540ec945b4246d086a00fce06a107da6d1fd72b7214
ssdeep: 384:Ca6/9mmebmeKSHrvtPItNSnXtp+bkFWNHWR9+EMQg:Cn9mVPLtfdYLY9lE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F5D2826293F80107F4BB3A7618760A546E37FC661B308A9F2760D14D5923BD5EC347AE
sha3_384: 6ed1b9448339cb35f5a4f3006e88f133fb20910c9d7c89a3b361626c423990ab4de79855b52c3a489d9e53db1c86c66f
ep_bytes: 558bec81ec94010000c785e4feffff04
timestamp: 2012-04-18 10:55:04

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Character Map
FileVersion: 5.00.2134.1
InternalName: charmap.exe
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999
OriginalFilename: charmap.exe
ProductName: Microsoft(R) Windows (R) 2000 Operating System
ProductVersion: 5.00.2134.1
Translation: 0x0409 0x04b0

Barys.953 also known as:

How to remove Barys.953?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.