Lazy.19852 (B) (file analysis)

The Lazy.19852 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Lazy.19852 (B) virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
A process created a hidden window
Executed a process and injected code into it, probably while unpacking
Exhibits behavior characteristic of iSpy Keylogger
Network activity detected but not expressed in API logs
Attempts to interact with an Alternate Data Stream (ADS)
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Lazy.19852 (B)?


File Info:
crc32: FC64D1C1
md5: 418e7612e77e68a986a5100395c0a810
name: 418E7612E77E68A986A5100395C0A810.mlw
sha1: 7979df9d50c9068f6b34519e76ec28ae58375802
sha256: 43594b6775cffcb4f111261881c5b1397bbab1c397d2e81f1cebcc283cd696df
sha512: 9df2e56c7bb4bb7bc6f51e2b247b5efd121d09e2b682d8f2474df2358d94a32ec5f5f08505554786cbe791bfedab93e6d697b8ddc00d2a0e09fdeb5ebb8f86f1
ssdeep: 24576:8U1qy+ZExjC5UvtYwskt5seF0xKh32R6uz1/z30AqKX/4dJ:g8iKhk0Ag
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 Loft Tech. 2019
Assembly Version: 1.0.0.0
InternalName: GrphDvc.exe
FileVersion: 1.0.0.0
CompanyName: Loft Tech.
ProductName: Graph Enhancer
ProductVersion: 1.0.0.0
FileDescription: Graph Enhancer
OriginalFilename: GrphDvc.exe

Lazy.19852 (B) also known as:

K7AntiVirus	Riskware ( 0040eff71 )
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader44.1891
MicroWorld-eScan	Gen:Variant.Lazy.19852
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.d50c90
ESET-NOD32	a variant of MSIL/Agent.UYF
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.MSIL.Bingoml.gen
BitDefender	Gen:Variant.Lazy.19852
Ad-Aware	Gen:Variant.Lazy.19852
Sophos	ML/PE-A
BitDefenderTheta	Gen:NN.ZemsilF.34294.hn0@ai3J3r
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
FireEye	Generic.mg.418e7612e77e68a9
Emsisoft	Gen:Variant.Lazy.19852 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Agent.xqjnv
eGambit	Unsafe.AI_Score_100%
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Lazy.19852
MAX	malware (ai score=83)
Panda	Trj/GdSda.A
AVG	Win32:MalwareX-gen [Trj]

How to remove Lazy.19852 (B)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Lazy.19852 (B) (file analysis)