Trojan

Trojan:Win32/Barys.GMA!MTB removal tips

Malware Removal

The Trojan:Win32/Barys.GMA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:Win32/Barys.GMA!MTB virus can do?

  • Sample contains Overlay data
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Barys.GMA!MTB?



File Info:

name: FE3D4CA4FBA074099468.mlw
path: /opt/CAPEv2/storage/binaries/059333f6e6a029a71313c111efa7096397c38893411fd7e1601485af8aba8905
crc32: E7FFF49B
md5: fe3d4ca4fba074099468803cc073128a
sha1: 764556a79867344dbab2b1d5541033773d9400e2
sha256: 059333f6e6a029a71313c111efa7096397c38893411fd7e1601485af8aba8905
sha512: 78644b7e21c79a2b6caaa1131952d6d0c591bf99652448fa178d103c53c37e4c36ccbc8871115a4cc2dd889b89345a0d0709ac26b8cec5d0bf00e851f8dbbddd
ssdeep: 6144:u2g+otjiJh7nFwcbFck3hmOne5nah/r9ngNBYtAw14b9Gfr14Yb3PRm6DyDRXAii:u2g+otuJlnGcbFck3cOe5ah/r9ngNBYH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F124BF2A630B5F76C69403F50BF6C6456E35E074F32903E6C0A8C35D07E3AAC65EB696
sha3_384: d2fc87ac8284faf49e2f7db378a423d4e38eef7766c133b44e84196e0cd96ccc60814cde534dbd8ab8f5e6c9a4536087
ep_bytes: 7cec75302cb5c1b72964f826eb27909c
timestamp: 1971-05-16 00:00:00


Version Info:

CompanyName: Wayne J. Radburn
FileDescription: PE/COFF File Viewer
FileVersion: 0.9.9.0
InternalName: PEview
LegalCopyright: Copyright© 1997-2011 Wayne J. Radburn
OriginalFilename: PEview.exe
ProductName: PEview
ProductVersion: 0.9.9.0
Translation: 0x0409 0x04e4

Trojan:Win32/Barys.GMA!MTB also known as:

BkavW32.AIDetectMalware
tehtrisGeneric.Malware
MicroWorld-eScanDeepScan:Generic.Dacic.8952383F.A.CF920DCB
SkyhighBehavesLike.Win32.Klez.dc
McAfeeTrojan-FVOQ!FE3D4CA4FBA0
MalwarebytesGeneric.Malware.AI.DDS
VIPREDeepScan:Generic.Dacic.8952383F.A.CF920DCB
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 0001b3411 )
K7GWTrojan ( 00571ed01 )
Cybereasonmalicious.798673
ArcabitDeepScan:Generic.Dacic.8952383F.A.CF920DCB
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Kryptik.HHBK
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Packed.Dridex-9861223-1
KasperskyHEUR:Trojan.Win32.Copak.pef
BitDefenderDeepScan:Generic.Dacic.8952383F.A.CF920DCB
NANO-AntivirusTrojan.Win32.PackedENT.ffvusb
SUPERAntiSpywareTrojan.Agent/Gen-Kryptik
AvastWin32:Evo-gen [Trj]
TencentTrojan.Win32.Kryptik.gify
TACHYONTrojan/W32.Selfmod
EmsisoftDeepScan:Generic.Dacic.8952383F.A.CF920DCB (B)
F-SecureTrojan.TR/Dropper.Gen
DrWebTrojan.PackedENT.192
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.fe3d4ca4fba07409
SophosMal/Inject-GJ
IkarusTrojan.Patched
WebrootW32.Trojan.Gen
VaristW32/Dacic.E.gen!Eldorado
AviraTR/Dropper.Gen
Antiy-AVLGrayWare/Win32.Kryptik.gifq
Kingsoftmalware.kb.a.1000
XcitiumTrojWare.Win32.Kryptik.TLS@812zm8
MicrosoftTrojan:Win32/Barys.GMA!MTB
ZoneAlarmHEUR:Trojan.Win32.Copak.pef
GDataDeepScan:Generic.Dacic.8952383F.A.CF920DCB
GoogleDetected
AhnLab-V3Packed/Win.FJB.C5538060
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.36608.n83@au6Updk
ALYacDeepScan:Generic.Dacic.8952383F.A.CF920DCB
MAXmalware (ai score=82)
VBA32Trojan.Khalesi
Cylanceunsafe
PandaTrj/Genetic.gen
RisingTrojan.Kryptik!1.B34D (CLASSIC)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/Kryptik.GIFQ!tr
AVGWin32:Evo-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:Win32/Barys.GMA!MTB?

Trojan:Win32/Barys.GMA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment