Lazy.441640 removal guide

The Lazy.441640 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Lazy.441640 virus can do?

CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with SmartAssembly
Authenticode signature is invalid

How to determine Lazy.441640?


File Info:
name: 81E322FFA4F08EF1CE49.mlw
path: /opt/CAPEv2/storage/binaries/ca340328a09ac92cb4560a3ae9b479d314c5aa1eb551e38bf138034cd41abce7
crc32: 732F13E6
md5: 81e322ffa4f08ef1ce49fc1401f523d6
sha1: aff846fdab534596a2b79d7d4b37813e25b9055f
sha256: ca340328a09ac92cb4560a3ae9b479d314c5aa1eb551e38bf138034cd41abce7
sha512: 529f6be71dac266ad62149434591e58892df222c822151bd1afd99d4fd27cc7f51f7b71b340a2408ac63029accf63d4b550167bbbb4d941df267750aed792507
ssdeep: 12288:Kr9NAc2ZJGgcAGBUS/3OCvY43AZ8LjY4D4DLi/aDgOdcGrZdD:K/MG+Y3ZvRAyLjY4D4DLcGrZdD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E2255C5A27456D6BC58DCE33C9D6BA47C736C4F0A74FE389285636AC0E163A38D418CB
sha3_384: 398fc458570ff175d40c0399a75cf166ad5d38879d0ebc6a252bb9f6337356d4c4459b8f74c919797d6eb2264e87b826
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-11-29 14:58:28

Version Info:
Translation: 0x0000 0x04b0
Comments: Microsoft Office
CompanyName: Microsoft Corporation
FileDescription: Microsoft Office
FileVersion: 16.0.13001.20266
InternalName: Lubsxc.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: Lubsxc.exe
ProductName: Microsoft Office
ProductVersion: 16.0.13001.20266
Assembly Version: 16.0.13001.20266

Lazy.441640 also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.AgentTesla.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Lazy.441640
FireEye	Gen:Variant.Lazy.441640
Skyhigh	Artemis!Trojan
McAfee	Artemis!81E322FFA4F0
Cylance	unsafe
Zillya	Downloader.Agent.Win32.536299
Sangfor	Downloader.Msil.AgentTesla.Vn4o
K7AntiVirus	Trojan-Downloader ( 005aec251 )
Alibaba	Backdoor:MSIL/AgentTesla.9ce8aad4
K7GW	Trojan-Downloader ( 005aec251 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Lazy.D6BD28
BitDefenderTheta	Gen:NN.ZemsilCO.36680.!m0@aCEt5Ej
VirIT	Trojan.Win32.Genus.UIT
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	MSIL/TrojanDownloader.Agent.PYH
Cynet	Malicious (score: 99)
APEX	Malicious
ClamAV	Win.Packed.Seraph-10016137-0
Kaspersky	HEUR:Backdoor.MSIL.Remcos.gen
BitDefender	Gen:Variant.Lazy.441640
Avast	Win32:MalwareX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13f8b39d
Emsisoft	Gen:Variant.Lazy.441640 (B)
F-Secure	Trojan.TR/Dldr.Agent.zriwh
DrWeb	Trojan.Packed2.45967
VIPRE	Gen:Variant.Lazy.441640
TrendMicro	TROJ_GEN.R002C0DL523
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
Webroot	W32.Malware.Gen
Varist	W32/MSIL_Kryptik.KEB.gen!Eldorado
Avira	TR/Dldr.Agent.zriwh
Antiy-AVL	Trojan[Downloader]/MSIL.Seraph
Kingsoft	MSIL.Backdoor.Remcos.gen
Xcitium	Malware@#20jrxudwzahkn
Microsoft	Trojan:MSIL/AgentTesla.TG!MTB
ZoneAlarm	HEUR:Backdoor.MSIL.Remcos.gen
GData	Gen:Variant.Lazy.441640
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5556722
VBA32	TScope.Trojan.MSIL
ALYac	Gen:Variant.Lazy.441640
MAX	malware (ai score=84)
Malwarebytes	Trojan.MalPack.MSIL
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0DL523
Rising	Malware.Obfus/MSIL@AI.96 (RDM.MSIL2:utsSXIem2LckucIEGSWidw)
MaxSecure	Trojan.Malware.73696032.susgen
Fortinet	PossibleThreat.MU
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Lazy.441640?

Lazy.441640 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X