Malware

Razy.143286 (B) removal instruction

Malware Removal

The Razy.143286 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Razy.143286 (B) virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous .NET characteristics
  • CAPE detected the RevengeRAT malware family

How to determine Razy.143286 (B)?



File Info:

name: E56607C4EF23A8C30381.mlw
path: /opt/CAPEv2/storage/binaries/fe8aa3fd7e5d4ceab74c35a51add1c30adc5e7e4fdbe902317032850601cfb86
crc32: 4842511C
md5: e56607c4ef23a8c30381ff48b64b1eb5
sha1: cfb102794d1c40c43abdfb635f0651177f400c3f
sha256: fe8aa3fd7e5d4ceab74c35a51add1c30adc5e7e4fdbe902317032850601cfb86
sha512: bfc9cbb6c3c08aa068037957dac8ecfd25590c57049fd040160149ae763c2cdeb3ae851961a99f8499d2f874d600cf29d81e194db908ac8b77b53c7a8fba524a
ssdeep: 1536:lCopp2U/PeUPAZ0TptJwHGxugKOiMng8p7yI:lCoSUjTJ4GUeiMnVpP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CE33D902B7874B52C85C29B540DF252503F09FCF5733EA5E3E8D065DAE22393AA687C9
sha3_384: e05368cbd92ac2a6f83b6f39c674298b2370b11156545d3da64b18e349cba55621fdfa3028c81df9c29d1f9d6802d42a
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-02-02 18:37:45


Version Info:

CompanyName: RV
FileDescription: Revenge-RAT Client
FileVersion: 0.0.0.3
InternalName: Revenge-RAT.exe
LegalCopyright: Copyright © Revenge-RAT 2016
OriginalFilename: Revenge-RAT.exe
LegalTrademarks: RV
ProductName: RV
ProductVersion: 0.0.0.3
Translation: 0x0409 0x04b0

Razy.143286 (B) also known as:

LionicTrojan.MSIL.Generic.4!c
Elasticmalicious (high confidence)
DrWebBackDoor.SpyBotNET.20
MicroWorld-eScanGen:Variant.Razy.143286
McAfeeArtemis!E56607C4EF23
CylanceUnsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 00560a551 )
AlibabaTrojan:MSIL/Revet.df2ddc6c
K7GWTrojan ( 00560a551 )
Cybereasonmalicious.4ef23a
BitDefenderThetaGen:NN.ZemsilF.34182.dq0@aW0OXyii
CyrenW32/HackKMS.C.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Agent.AZM
TrendMicro-HouseCallTROJ_GEN.R002C0RB622
ClamAVWin.Dropper.LimeRAT-9776087-0
KasperskyHEUR:Trojan.MSIL.Generic
BitDefenderGen:Variant.Razy.143286
AvastWin32:RATX-gen [Trj]
TencentMsil.Trojan.Generic.Ajle
EmsisoftGen:Variant.Razy.143286 (B)
TrendMicroTROJ_GEN.R002C0RB622
McAfee-GW-EditionArtemis!Trojan
FireEyeGeneric.mg.e56607c4ef23a8c3
SophosML/PE-A + Mal/Revet-A
SentinelOneStatic AI – Malicious PE
AviraHEUR/AGEN.1222278
MAXmalware (ai score=89)
MicrosoftBackdoor:Win32/Bladabindi!ml
GDataMSIL.Backdoor.RevengeRAT.D
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Revenge.R209261
ALYacGen:Variant.Razy.143286
MalwarebytesBackdoor.RevengeRAT.Generic
APEXMalicious
RisingBackdoor.Revetrat!8.E4C1 (CLOUD)
IkarusBackdoor-Rat.Revenge
eGambitTrojan.Generic
FortinetMSIL/Agent.AZM!tr
AVGWin32:RATX-gen [Trj]
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Razy.143286 (B)?

Razy.143286 (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment