What is “Razy.129449”?

The Razy.129449 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.129449 virus can do?

Anomalous file deletion behavior detected (10+)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Razy.129449?


File Info:
name: FAF352E7EB4691317E06.mlw
path: /opt/CAPEv2/storage/binaries/b92b1d6884afef0de6b016cf2b41d0d0443832b9477f0f07456eb405b30ceae9
crc32: 524B26D0
md5: faf352e7eb4691317e06ef78b0264cb1
sha1: 0e5273d0b61a92f6d7ce1a43ddc0f96f82b195e0
sha256: b92b1d6884afef0de6b016cf2b41d0d0443832b9477f0f07456eb405b30ceae9
sha512: 4be341210cb7b75c7a6591fe27ea0c0cbce72c54d4d5084209dec9c417c26a7213f2ba0ccc1e63faba61202d6f974399e7eb5deb0efbaa874453a683a747db02
ssdeep: 3072:zTsZB+70AwdxhnCwijJP60r6/8H/xQxn4Hyyt27hYYYYYYYYYYYYYYYYiYYYYYYJ:itAwzdi56Q60fQ3o27Os6ZZXGpDNWL
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T106449E427136E2F4E428C83A556371FA67C76DA15E0E6E142059BF3739B22D0AF0D63B
sha3_384: 196422fd3d340694aab881107da8b2f678ca1a917797ebd0fae5dcb7de3dd02aa97fec29aebd6f58a0924f0d948d228d
ep_bytes: 558bece85ef5ffffc300000000000000
timestamp: 2008-02-23 18:43:56

Version Info:
0: [No Data]

Razy.129449 also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.Packed.21305
MicroWorld-eScan	Gen:Variant.Razy.129449
FireEye	Generic.mg.faf352e7eb469131
CAT-QuickHeal	Trojan.Rimecud.AA
McAfee	W32/Rimecud.gen.g
Cylance	Unsafe
VIPRE	Gen:Variant.Razy.129449
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0040fa5f1 )
BitDefender	Gen:Variant.Razy.129449
K7GW	Trojan ( 0040fa5f1 )
Cybereason	malicious.7eb469
Arcabit	Trojan.Razy.D1F9A9
BitDefenderTheta	AI:Packer.1A2B38D720
Cyren	W32/Rimecud.M.gen!Eldorado
Symantec	W32.Pilleuz!gen14
ESET-NOD32	a variant of Win32/Kryptik.IEI
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
Rising	Malware.FakeFolder/ICON!1.6AA9 (CLASSIC)
Ad-Aware	Gen:Variant.Razy.129449
Sophos	Mal/Generic-R + Mal/EncPk-ACO
Comodo	TrojWare.Win32.Kryptic.HJM@25m8dn
TrendMicro	WORM_PALEVO.SMWX
McAfee-GW-Edition	W32/Rimecud.gen.g
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Razy.129449 (B)
Ikarus	Trojan.Win32.Crypt
Avira	TR/Crypt.XPACK.Gen
MAX	malware (ai score=83)
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Razy.129449
Cynet	Malicious (score: 100)
AhnLab-V3	Worm/Win32.Palevo.R1904
Acronis	suspicious
VBA32	BScope.Backdoor.Vawtrak
ALYac	Gen:Variant.Razy.129449
Panda	Trj/Rimecud.a
TrendMicro-HouseCall	WORM_PALEVO.SMWX
Tencent	Win32.Trojan.Genome.Ehrn
Yandex	Trojan.Kryptik!tBi+QI68f14
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Rimecud-G [Trj]
Avast	Win32:Rimecud-G [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Razy.129449?

Razy.129449 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X