Categories: Malware

About “Razy.106201” infection

The Razy.106201 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.106201 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Network activity detected but not expressed in API logs

Related domains:

wpad.local-net

How to determine Razy.106201?


File Info:
name: 77F27438EF6CF2092329.mlwpath: /opt/CAPEv2/storage/binaries/445e0232d22364d114992cf818ab2c2a3db0a412b425f13ad196e45677f6df1ecrc32: 908F37A3md5: 77f27438ef6cf20923295625da9e0397sha1: 8f86824811c669f992b3407668475ba6b461da48sha256: 445e0232d22364d114992cf818ab2c2a3db0a412b425f13ad196e45677f6df1esha512: 0d954a6933e38545d2b50da99d9a32114aa8cf7bda9ceab2a957879994f43f9bfadf877962141eeab7c01560913ed06fe0c00cd2daa687d5d95011526654c89fssdeep: 1536:hie3XcCbofRw/dzEdFfTYG0xsBYtoPFQhPwbofRw/lzEdFfT:1nbe2dzEdFfTYG0xsBbF0ue2lzEdFfTtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F29490623790CF22C78607B7CA035B9406585C18B790ED75A4E06AFE95A4EFACDCF183sha3_384: 61163d31abcb2d7153fd977f1f7e314cd57cdaa0eda28fe34161bc9475a29ee4b2482582eb33c91604f168da3e6ea7feep_bytes: ff250020400000000000000000000000timestamp: 2013-11-23 18:00:52
Version Info:
Translation: 0x0000 0x04b0FileDescription: מנוי למיקמק חינםFileVersion: 1.0.0.0InternalName: מנוי למיקמק חינם.exeLegalCopyright: Copyright ©  2013OriginalFilename: מנוי למיקמק חינם.exeProductName: מנוי למיקמק חינםProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Razy.106201 also known as:

Lionic	Trojan.Multi.Generic.4!c
FireEye	Gen:Variant.Razy.106201
McAfee	Artemis!77F27438EF6C
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.MSIL.Agent.RKP
K7AntiVirus	Password-Stealer ( 004b969d1 )
Alibaba	Trojan:MSIL/Tiggre.4587e383
K7GW	Password-Stealer ( 004b969d1 )
Cybereason	malicious.8ef6cf
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	MSIL/PSW.Agent.RKP
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Razy.106201
MicroWorld-eScan	Gen:Variant.Razy.106201
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Spy.Akza
Ad-Aware	Gen:Variant.Razy.106201
Emsisoft	Gen:Variant.Razy.106201 (B)
Comodo	Malware@#3oq2554r9f0el
Zillya	Trojan.Agent.Win32.1190068
TrendMicro	TROJ_GEN.R002C0GGL21
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Razy.106201
Avira	HEUR/AGEN.1106949
Antiy-AVL	Trojan/Generic.ASMalwS.1BBF515
Kingsoft	Win32.Troj.Tpyn.c.(kcloud)
Arcabit	Trojan.Razy.D19ED9
Microsoft	Backdoor:Win32/Bladabindi!ml
BitDefenderTheta	Gen:NN.ZemsilCO.34294.Aq0@aW91Nmp
ALYac	Gen:Variant.Razy.106201
MAX	malware (ai score=100)
VBA32	TScope.Trojan.MSIL
TrendMicro-HouseCall	TROJ_GEN.R002C0GGL21
Yandex	Trojan.Tpyn!rShDgnN6zKQ
Ikarus	Trojan-Spy.Agent
Fortinet	MSIL/Agent.NQK!tr
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.1728101.susgen