Trojan:Win32/Barys.GMA!MTB malicious file

The Trojan:Win32/Barys.GMA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Barys.GMA!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Creates a copy of itself
• Deletes executed files from disk
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Barys.GMA!MTB?

File Info:
name: ED0F21FD91C26430C94B.mlw
path: /opt/CAPEv2/storage/binaries/caf1bc601cc923933b1dc320bc46281828d311f6975e185990c7ebfe659207df
crc32: 77553D6B
md5: ed0f21fd91c26430c94b865bb3233cad
sha1: 1ba437a5317289ba4147039e1c0fc05d63aa93b3
sha256: caf1bc601cc923933b1dc320bc46281828d311f6975e185990c7ebfe659207df
sha512: 14d03f9286ccbc0441f1943d0db6d9ebf75163bfeec7bf607b30e33a49c7db99e6a82cddf8b1ae27a8d2ba5a0635feaf4cea6f68396aa7eaaf0bb5d0a9d6ba85
ssdeep: 6144:3khP8GkHeib3x6FJj/hypzH5K2zJ91+j0a58g1vi8FKiSJdRsZ:3khP8fHfcFR/hwzc2zJ91+Ya58g1vi81
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19914BE4DF60DCEE2C1C903F11FEE82CB696E941C5369016B60F3F55EDAA742895BB218
sha3_384: 215655df0dffcc858288949bb024c583925d454d218708352124d661bc487625b07afa42e601f2f07b6f9cc012a19a95
ep_bytes: 3ce27f8b6cbbcb0c696af29dab299a27
timestamp: 1971-05-16 00:00:00

Version Info:
CompanyName: Wayne J. Radburn
FileDescription: PE/COFF File Viewer
FileVersion: 0.9.9.0
InternalName: PEview
LegalCopyright: Copyright© 1997-2011 Wayne J. Radburn
OriginalFilename: PEview.exe
ProductName: PEview
ProductVersion: 0.9.9.0
Translation: 0x0409 0x04e4

Trojan:Win32/Barys.GMA!MTB also known as:

How to remove Trojan:Win32/Barys.GMA!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.