Trojan

Trojan:Win32/Barys.GMA!MTB (file analysis)

Malware Removal

The Trojan:Win32/Barys.GMA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:Win32/Barys.GMA!MTB virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family

How to determine Trojan:Win32/Barys.GMA!MTB?



File Info:

name: 740C380C7ADF44EC6CCF.mlw
path: /opt/CAPEv2/storage/binaries/a49f393c668144fe05ce165c8c7d6e02e1f3733952c863450b9f429f62d8dc09
crc32: DA31A7E2
md5: 740c380c7adf44ec6ccfa1df1e3c3196
sha1: ecafea1c8127a61dde251cb8722d83ca67989166
sha256: a49f393c668144fe05ce165c8c7d6e02e1f3733952c863450b9f429f62d8dc09
sha512: bd25d2c30267fb2779f2f1d925c830e63832818c2e09c2c0ef5b016166c5a56734bd16a5e1f3dcf3b333038371038bdc4c2eb08f853d7f48295bc20389d5c9f3
ssdeep: 3072:MJKQhXJCWp5p9HnGBTc8LjY1sXXolhQ7MfP6fYqR5wpd1+gDR1Xhw4lEJGMsget:MJzhXJCWp0NahQ7MkXR2pdDgsZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E114C0C3BD0D2BDAC48B0234DFEEE2AB5298E8561391465710ECF24F175A525CEEE790
sha3_384: e5b8fb4b421887bafde77d5b79d3885e3be96bdc4761c14a4c54fa80707be5e145cd4a0456d69fc4ee4b1225c2f2c7fb
ep_bytes: 9475f770c42c43f7c1fd7a6603be12dc
timestamp: 1971-05-16 00:00:00


Version Info:

CompanyName: Wayne J. Radburn
FileDescription: PE/COFF File Viewer
FileVersion: 0.9.9.0
InternalName: PEview
LegalCopyright: Copyright© 1997-2011 Wayne J. Radburn
OriginalFilename: PEview.exe
ProductName: PEview
ProductVersion: 0.9.9.0
Translation: 0x0409 0x04e4

Trojan:Win32/Barys.GMA!MTB also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Dacic.4!c
tehtrisGeneric.Malware
MicroWorld-eScanDeepScan:Generic.Dacic.8952383F.A.E5C9A98E
ClamAVWin.Packed.Dridex-9861223-1
FireEyeGeneric.mg.740c380c7adf44ec
SkyhighBehavesLike.Win32.VFlooder.dc
McAfeeTrojan-FVOQ!740C380C7ADF
Cylanceunsafe
ZillyaTrojan.Kryptik.Win32.4414628
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 0001b3411 )
AlibabaTrojan:Win32/Barys.fda1c56f
K7GWTrojan ( 00571ed01 )
Cybereasonmalicious.c8127a
BitDefenderThetaGen:NN.ZexaF.36680.m40@aazQJtd
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Kryptik.HHBK
APEXMalicious
CynetMalicious (score: 100)
KasperskyUDS:Trojan.Win32.Copak
BitDefenderDeepScan:Generic.Dacic.8952383F.A.E5C9A98E
NANO-AntivirusTrojan.Win32.Kryptik.foobtk
SUPERAntiSpywareTrojan.Agent/Gen-Kryptik
AvastWin32:Evo-gen [Trj]
TencentTrojan.Win32.Kryptik.gify
TACHYONTrojan/W32.Selfmod
SophosMal/Inject-GJ
F-SecureTrojan.TR/Crypt.XPACK.Gen
DrWebTrojan.Siggen22.55984
VIPREDeepScan:Generic.Dacic.8952383F.A.E5C9A98E
TrendMicroTROJ_GEN.R002C0DLS23
EmsisoftDeepScan:Generic.Dacic.8952383F.A.E5C9A98E (B)
IkarusTrojan.Patched
GDataWin32.Trojan.PSE.82PTV4
JiangminTrojan.Generic.clmtx
WebrootW32.Trojan.Gen
GoogleDetected
AviraTR/Crypt.XPACK.Gen
Antiy-AVLGrayWare/Win32.Kryptik.gifq
Kingsoftmalware.kb.a.977
XcitiumTrojWare.Win32.Kryptik.TLS@812zm8
ArcabitDeepScan:Generic.Dacic.8952383F.A.E5C9A98E
ZoneAlarmUDS:Trojan.Win32.Copak
MicrosoftTrojan:Win32/Barys.GMA!MTB
VaristW32/Dacic.E.gen!Eldorado
AhnLab-V3Packed/Win.FJB.R621438
ALYacDeepScan:Generic.Dacic.8952383F.A.E5C9A98E
MAXmalware (ai score=85)
VBA32Trojan.Khalesi
MalwarebytesGeneric.Malware.AI.DDS
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_GEN.R002C0DLS23
RisingTrojan.Kryptik!1.B34D (CLASSIC)
YandexTrojan.Kryptik!3n/O67DCCys
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Kryptik.GIFQ!tr
AVGWin32:Evo-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:Win32/Barys.GMA!MTB?

Trojan:Win32/Barys.GMA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment