Trojan.Barys.GA

The detection of Trojan.Barys.GA on your system indicates a potential security threat that requires immediate attention. Trojans are a type of malware that can cause significant harm to your computer and compromise your personal data. In this report, we will provide an overview of the threat, its operating methods, symptoms of infection, and steps to remove it from your system.

What Is Trojan.Barys.GA?

Trojan.Barys.GA is a type of Trojan horse malware that can infect your computer without your knowledge or consent. The name "Trojan.Barys.GA" is a detection label used by security software to identify this specific threat. It is essential to understand that Trojans are designed to disguise themselves as legitimate programs, making them difficult to detect. They can be spread through various means, including infected software downloads, suspicious email attachments, and compromised websites.

How Trojan.Barys.GA Operates

Once installed, Trojan.Barys.GA can operate in the background, allowing an attacker to access your system remotely. This can lead to a range of malicious activities, including data theft, system compromise, and the installation of additional malware. Trojans can also create backdoors, allowing hackers to bypass security measures and gain unauthorized access to your system. The primary goal of a Trojan is to remain undetected, making it crucial to use reputable security software to detect and remove these threats.

Symptoms of Infection

Identifying the symptoms of a Trojan infection can be challenging, as they often mimic legitimate system behavior. However, some common indicators of a potential Trojan infection include slow system performance, unexpected pop-ups or advertisements, and unfamiliar programs or icons on your desktop. You may also experience issues with your internet connection, such as frequent disconnections or unexplained changes to your browser settings. If you suspect that your system is infected with Trojan.Barys.GA, it is essential to take immediate action to remove the threat.

How to Remove Trojan.Barys.GA

1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for internet access. This will enable you to download and install removal tools.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. This will help detect and remove the Trojan and any associated malware.
3. Uninstall any suspicious programs or applications that you do not recognize or that were installed without your consent. Be cautious when removing programs, as some may be legitimate.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings. This will help remove any malicious extensions or add-ons that may have been installed by the Trojan.
5. Reboot your system and perform another full scan to ensure that the Trojan and any associated malware have been successfully removed.

Conclusion

Removing Trojan.Barys.GA from your system requires a combination of technical knowledge and the right tools. By following the steps outlined in this report, you can help ensure the successful removal of the threat and prevent future infections. It is essential to remain vigilant and to use reputable security software to protect your system from malware threats. Regular system updates, cautious internet browsing, and the use of strong antivirus software can all help to prevent Trojan infections and keep your personal data safe.

Analysis Report

General information

Family Name:	Trojan.Barys.GA
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: c405202843fd238e2c8491f586c2cd34 SHA1: b5b968f77bb0c66827a8b7e9ba7167068299a16a File Size: 426.81 KB, 426805 bytes

MD5: e7fa9ad539a658dc238cc9f7a956c96c SHA1: 6d000f70e08ece2df91965f3d1d1862837a9b9a8 SHA256: 20584BC03BF474214B03952258F4B3EE359763415502B92E64F890E665BE4C78 File Size: 390.19 KB, 390192 bytes

MD5: c0a2adfe623b07e017df8c7746318f12 SHA1: e2194f311d633bcdc0ba5a24b89bcb669a0d2380 SHA256: CE76F805EA7CCCF91AD087C131E547DFB5B04CC7DA53AC7632785661104C553A File Size: 525.55 KB, 525555 bytes

MD5: ec10621e191df3beb82dfba062e37b69 SHA1: 0b8d65fba440ba3351386b6f9520dace11cabc5c SHA256: 206BDC3EEF4C9B2B83FB9B1691D3375292CA7DAC401800E3511F1C9551410D17 File Size: 463.28 KB, 463279 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Astersoft Sistemas Ltda Sina Nourian
File Description	Aster Boleto Sistema automático de backup's Swift Remote
File Version	v1.0.2 1.0.2.0 1.0
Internal Name	Aster Boleto Interbackup SwiftRemote
Legal Copyright	Astersoft Sistemas Ltda Developed By: Sina Nourian Interage Sistemas
Original Filename	aster-boleto.exe Interbackup.exe SwiftRemote.exe
Product Name	Aster Boleto Interbackup Swift Remote
Product Version	v2.0.1 1.0.2.0 1.0

File Traits

• No Version Info
• WinZip SFX
• x86
• ZIP (In Overlay)
• ZIPinO

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-��LG=�A��J� �C �	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix	Cookie:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix	Visited:	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	-P  �r� v  � �* ��� �8 \x� �B +� �� �6 �}�� �� 7� xy �� �� ۀ  > �= �������B�O���� �x�% ���8 �5���� Bx��������\�! I N�sb �! > !wz#@�#�� #�O $kF $��$¨%:	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	.P  �r� v  � �* ��� �8 \x� �B +� �� �6 �}�� �� 7� xy �� �� ۀ  > �= �������B�O���� �x�% ���8 �5���� Bx��������\�! I N�sb �! > !wz#@�#�� #�O $kF $��$¨%:	RegNtPreCreateKey
HKCU\software\microsoft\edge\blbeacon::failed_count		RegNtPreCreateKey
HKCU\software\microsoft\edge\blbeacon::state		RegNtPreCreateKey
HKCU\software\microsoft\edge\thirdparty::statuscodes	(NULL)	RegNtPreCreateKey
HKCU\software\microsoft\edge\thirdparty::statuscodes		RegNtPreCreateKey

Show More

HKCU\software\microsoft\edge\blbeacon::state		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	墦 ĸ⬉ʾ鈉øꌉĶꄍ阎Ľ鬎ʂ먎ÍԏÞ阐†䈑Âø밓Ɣ똕ĥ츕ë䈛x䤝Ē猟ɢ䀣ʲ찣ŏ갤Ç숤ʨ春ʐ븥ė椧ĒꄨěสĹ뜪Ģ윪Þ㴬倰ĥ䠱Oⰵɝ혺ɲ츻Ĵ噀ñ끀Ī덂®䡆¶賂¦홌ʅ቎ĤÁꝒª穔R띔Ü录Ī乖ʗ瑜ť፡Ĥ陣w걣ʛづŔ퍥h坧ʡ㹭ŃŁ詰ʜ䁱£	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	墧 ĸ⬉ʾ鈉øꌉĶꄍ阎Ľ鬎ʂ먎ÍԏÞ阐†䈑Âø밓Ɣ똕ĥ츕ë䈛x䤝Ē猟ɢ䀣ʲ찣ŏ갤Ç숤ʨ春ʐ븥ė椧ĒꄨěสĹ뜪Ģ윪Þ㴬倰ĥ䠱Oⰵɝ혺ɲ츻Ĵ噀ñ끀Ī덂®䡆¶賂¦홌ʅ቎ĤÁꝒª穔R띔Ü录Ī乖ʗ瑜ť፡Ĥ陣w걣ʛづŔ퍥h坧ʡ㹭ŃŁ詰ʜ䁱£	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-��LG=�A��J� �C �	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	%k �8��8 tX��B �� �6 �v5��Z xy ����T�B�������������5����ee �� Bx�< �!wz"Wc#�#�� $kF $��%"�%:�%� &� &�x(�(X�)�`*J*9 *�" *�^ *�h+�[,��/9�/��0P% 1`1�1HO1�D5�05�G	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	&k �8��8 tX��B �� �6 �v5��Z xy ����T�B�������������5����ee �� Bx�< �!wz"Wc#�#�� $kF $��%"�%:�%� &� &�x(�(X�)�`*J*9 *�" *�^ *�h+�[,��/9�/��0P% 1`1�1HO1�D5�05�G	RegNtPreCreateKey
HKCU\software\microsoft\edge\elfbeacon::version	143.0.3650.80	RegNtPreCreateKey
HKCU\software\microsoft\edge\blbeacon::failed_count		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Shell Execute	CreateProcess ShellExecute
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDeleteValueKey Show More ntdll.dll!NtDuplicateToken ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtPowerInformation ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetValueKey ntdll.dll!NtTestAlert ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWriteFile ntdll.dll!NtWriteVirtualMemory UNKNOWN win32u.dll!NtUserGetKeyboardLayout win32u.dll!NtUserGetThreadState
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

open http://java.com/download

open http://java.com/download/

open http://www.java.com/download

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://www.java.com/download