About “Trojan.Win32.Bayrob.hyyr” infection

The Trojan.Win32.Bayrob.hyyr is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Bayrob.hyyr virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid

How to determine Trojan.Win32.Bayrob.hyyr?

File Info:
name: F01C9C97AEFED620B4AB.mlw
path: /opt/CAPEv2/storage/binaries/c8e26881f106f459c09fa6ee3149a323bd717a6e3187977f5b207968c29295d9
crc32: 6862C2F5
md5: f01c9c97aefed620b4aba4c48ba97fbc
sha1: 3a56ec1d4873e97cc776f76e100415b13d47fdc9
sha256: c8e26881f106f459c09fa6ee3149a323bd717a6e3187977f5b207968c29295d9
sha512: fd453faa7ca7654631f2755758edaf07d992b78d96865a159c2dcbcb01dd3565a72c80b31b08703d7710e11935fd619ce3769a6c1dcfa568ba6e69c0b84b1853
ssdeep: 1536:bXwupAn8qhxFbIP/LyGvQMNSOoWdgHebH5Dn5WREEC6h6H0E6IheAAxD8g66fGwy:jwupA8qh3cP/LyGvQMNSHWMeD5tWR14r
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16A931216496749BADB60D177878B062A4E7A643F390186E33D3D4FF1B87EA734A3C081
sha3_384: 0dc10cde1d846e5b6c9e7623ccac18649c8bc764a48a91f34299a97a46a6b81995fa66934a9e05a0489ce4387a81abfe
ep_bytes: 558bec81eca8080000c745f400000000
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan.Win32.Bayrob.hyyr also known as:

How to remove Trojan.Win32.Bayrob.hyyr?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.