Razy.297663 (file analysis)

The Razy.297663 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.297663 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (3 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
At least one IP Address, Domain, or File Name was found in a crypto call
Performs some HTTP requests
Sniffs keystrokes
Attempts to create or modify system certificates
Makes SMTP requests, possibly sending spam or exfiltrating data.

Related domains:

z.whorecord.xyz

a.tomx.xyz

smtp.gmail.com

How to determine Razy.297663?


File Info:
crc32: AB08990F
md5: 077feb5ddd29cd432e26339434191866
name: 077FEB5DDD29CD432E26339434191866.mlw
sha1: ee8bb464656ffb2b3ca2417cdb9acdb349a59167
sha256: 582df6511893d33698003e36d004808b2d1ed8912a81753e52d4c45274c0e78c
sha512: 2cf8c9080482b993271cc8e7d92dc2ab3bc9d81d39545e0fe03847a13e278def1a7e158d74266e198280bf957a878ed76c870356f9155cc64a7a63158c8d3e66
ssdeep: 768:8xjGqzXjTzBGPiZAKVtl0n8m1qLONJwKs31wP7mb2xptRJq7D5lrhrIThUVWJPv:UjGqzXjTzBGPihVtl0n8m1qLONJwKs3
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: hSrPau
Assembly Version: 4.31.28.2
InternalName: s1.exe
FileVersion: 5.13.83.34
CompanyName: sErUWu
Comments: rPldJbneuGfqKaDco
ProductName: GyhcbEUoTlgadcP
ProductVersion: 5.13.83.34
FileDescription: dYrUPhQwZacAfacBflA
OriginalFilename: s1.exe

Razy.297663 also known as:

K7AntiVirus	Spyware ( 004b9a521 )
Cylance	Unsafe
Zillya	Trojan.Blocker.Win32.39805
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Spyware ( 004b9a521 )
Cybereason	malicious.ddd29c
BitDefenderTheta	Gen:NN.ZemsilF.34050.cm0@aq@!Bcp
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.Blocker.kybk
BitDefender	Gen:Variant.Razy.297663
NANO-Antivirus	Trojan.Win32.Blocker.ezornq
Tencent	Win32.Trojan.Blocker.Fil
Ad-Aware	Gen:Variant.Razy.297663
Sophos	Mal/Generic-S
DrWeb	Trojan.DownLoader26.35167
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Generic.drh
Emsisoft	Gen:Variant.Razy.297663 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Spy.Gen
Arcabit	Trojan.Razy.D48ABF
ZoneAlarm	Trojan-Ransom.Win32.Blocker.kybk
Microsoft	Trojan:Win32/Dynamer!rfn
McAfee	Generic.drh
MAX	malware (ai score=98)
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/GdSda.A
Yandex	Trojan.Blocker!sIdIts4PWxk
Ikarus	Trojan.MSIL.Spy
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.BO!tr.spy
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.Blocker.HwMAEpsA

How to remove Razy.297663?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Razy.297663 (file analysis)