What is “Lazy.74737”?

The Lazy.74737 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Lazy.74737 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Russian
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• CAPE detected the CryptBot malware family
• Attempts to identify installed AV products by installation directory
• Checks the CPU name from registry, possibly for anti-virtualization
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Lazy.74737?

File Info:
name: F857781F99627FA6F043.mlw
path: /opt/CAPEv2/storage/binaries/575e4bc14adc946622585a452cc7150ca1a188628916e7006d17309cba78406e
crc32: 6061077E
md5: f857781f99627fa6f0433b94974bd01a
sha1: 5f243122bc4e211a4298fcaf7dbb5dce6727b7ba
sha256: 575e4bc14adc946622585a452cc7150ca1a188628916e7006d17309cba78406e
sha512: 7557bbad532a759dfd6344b6cfe20b1a9c6b1b789f0d1f702e7d72df5b85c2a92b2b15ed25d21b4ce55d859f80884b3d94c72b875254f68fac6e4bf17763e737
ssdeep: 12288:okutj+GM+2Vl0X2xLukP0oYnDOpUGQSwNe3kuqX5UeinhnhPAejzOJYp:luoGM+Gl0m0TItHaecpU34Yp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C265916BA5B9FF4DD4678531DA52B7E2901ABD017312CD69C28BBC24B8343A43AC3D47
sha3_384: 704dfc8ab5266e3ecc114fc5087d46638c528dd541621cc5be932337f8c2bbfd74a8c2aa76f5405a68a1234aa7f09a2c
ep_bytes: b98201000033d252ff154bc0450009c0
timestamp: 2021-12-05 03:08:49

Version Info:
CompanyName: VirusBlokAda Ltd.
FileDescription: Vba32 Loader
FileVersion: 3, 11, 0, 0
InternalName: vba32ldr-NTP
LegalCopyright: Copyright © VirusBlokAda Ltd. 1993-2009
OriginalFilename: Vba32Ldr.exe
ProductName: Vba32 Loader
ProductVersion: 3, 11, 0, 0
Translation: 0x0419 0x04b0

Lazy.74737 also known as:

How to remove Lazy.74737?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.