Should I remove “Lazy.209499”?

The Lazy.209499 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Lazy.209499 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks the CPU name from registry, possibly for anti-virtualization
• Attempts to access Bitcoin/ALTCoin wallets
• Harvests credentials from local FTP client softwares
• Installs WinPCAP

How to determine Lazy.209499?

File Info:
name: 5C8FDE8BE32F971F1422.mlw
path: /opt/CAPEv2/storage/binaries/11b9455be677cd06d350b61510ebaa36a9d80458095199844d61062a23525e30
crc32: C812FFD5
md5: 5c8fde8be32f971f1422b5ab00d7dec7
sha1: 0ac3b1898cd9b2cf677be89b094c54f17916638c
sha256: 11b9455be677cd06d350b61510ebaa36a9d80458095199844d61062a23525e30
sha512: 215667277cde721bcebae6658e71857a4b21a66dabab6a34b555ab1c1568deed07aad3aafbf4323d8b70bd76b4cf1bf3d9b46d288c58d6717a51cebd3ecd1fcd
ssdeep: 12288:VjPoXDFmZyWabcJjp36Y6W8uLfARsNax+P+eCt7KIzGFmy5mcSD:yIncY6W8sfARsNMsTCtGIzSmCmLD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1570523CD72A76526FD209EF05FE301EE2B4219256F6514043CED14813A167AADF9E7F0
sha3_384: 56cb36d2ec81bd6c76019935b0b83dfd80bc4ed037e6b0c29ebafd5d897cfa9d318f34fa3c9bdf1280b89b2af921b9eb
ep_bytes: 558bec83ec588b052c4a4d008945b453
timestamp: 2005-02-11 06:32:19

Version Info:
ProductName: VG6zs
FileDescription: aa5KGRYGG52
CompanyName: 7nPaX6CEMNDE
FileVersion: 255.106.109.31
ProductVersion: 255.106.109.31
OriginalFilename: kAbz6tC0qxxg2y
InternalName: 14XNjNy
Translation: 0x0409 0x04b0

Lazy.209499 also known as:

How to remove Lazy.209499?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.