Categories: Malware

What is “Lazy.10109 (B)”?

The Lazy.10109 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Lazy.10109 (B) virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous binary characteristics

Related domains:

wpad.local-net

How to determine Lazy.10109 (B)?


File Info:
name: 8CAACC965A6C0D9F79B2.mlwpath: /opt/CAPEv2/storage/binaries/f9a4726aaa13e2ab2e000ebf0ed1d8f657e4cde0c86624f7fc6eb05838581e51crc32: 787356BDmd5: 8caacc965a6c0d9f79b27996bc52088dsha1: ada05304bbb2ef1991182d5d69ca69b9a79ed488sha256: f9a4726aaa13e2ab2e000ebf0ed1d8f657e4cde0c86624f7fc6eb05838581e51sha512: bdc2354dee1186fc9a2c200b72df56d9e2b5eae3a587cce1992144afe4d672bc7df215c6c8ee2c923df3f12b7143e2310bb4d78bf82bd20e21a9857e806f079essdeep: 98304:DkPpuHgO5zPO4zMcOe8piQHkmy1y3JyZL:DkRub5zP9pQHpEy3JyZLtype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T1D9566B0173D58062ECB206309C7E767592B6BC611B2EC3DF5249BAED0E316E2D9747E2sha3_384: f547783da75236d3c046a00af71e087fd2b6ad14a657a4ae2da8688d7a908981e3e70991b182df9a6216ef299ce6a730ep_bytes: ff250020400000000000000000000000timestamp: 2007-10-24 03:31:10
Version Info:
CompanyName: Microsoft CorporationFileDescription: Microsoft .NET Assembly Registration UtilityFileVersion: 2.0.50727.1433 (REDBITS.050727-1400)InternalName: RegAsm.exeLegalCopyright: © Microsoft Corporation.  All rights reserved.OriginalFilename: RegAsm.exeProductName: Microsoft® .NET FrameworkProductVersion: 2.0.50727.1433Comments: Flavor=RetailTranslation: 0x0409 0x04b0

Lazy.10109 (B) also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Lazy.10109
Cylance	Unsafe
Cyren	W32/Autorun.DZ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ClamAV	Win.Packed.Generic-6848149-0
Kaspersky	not-a-virus:UDS:RiskTool.Win64.Injector.a
BitDefender	Gen:Variant.Lazy.10109
Avast	Win32:Trojan-gen
Ad-Aware	Gen:Variant.Lazy.10109
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Fujacks.th
FireEye	Generic.mg.8caacc965a6c0d9f
Emsisoft	Gen:Variant.Lazy.10109 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1142787
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Lazy.D277D
GData	Gen:Variant.Lazy.10109
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Lazy.10109
APEX	Malicious
Ikarus	Trojan.Dropper
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/SPNR.15EG12!tr
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_80% (D)