About “Razy.370824” infection

The Razy.370824 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.370824 virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine Razy.370824?


File Info:
crc32: BC3EA54F
md5: a65a93ba771c44dc3b8de478c24aecab
name: A65A93BA771C44DC3B8DE478C24AECAB.mlw
sha1: c2f1c51ebb99de9d86a2201b6a8c91686221a03a
sha256: 02f1d7e3a836b1bf6882ed1eba5d2419075e9bef98ef1b845c25f45f9c16c4f3
sha512: cf2ff3d958166ebee78857e6a98da7c6a8d7a813322a38459bae562b713f0ea7f05b238a0bf77ef2a8da558354895ab4a9bd405cb4c27dce7e717576ac0ee256
ssdeep: 6144:o5tDdFzSyciHr8aJBHOwiT/9hC3gRUJVGbk3jf1cSz05dGMb03:ozzfDLHVjEcyFY3jfySz0vG
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: DmNotificationBroker
FileVersion: 10.0.16299.15 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.16299.15
FileDescription: DmNotificationBroker
OriginalFilename: DmNotificationBroker.exe
Translation: 0x0409 0x04b0

Razy.370824 also known as:

K7AntiVirus	Trojan ( 0053924c1 )
Lionic	Trojan.Win32.Generic.i!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Razy.370824
Cylance	Unsafe
Sangfor	Trojan.MSIL.Agent.SSK
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	TrojanPSW:MSIL/MalwareX.0dfe713c
K7GW	Trojan ( 0053924c1 )
Cybereason	malicious.a771c4
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent.SSK
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.Win32.Agent.gen
BitDefender	Gen:Variant.Razy.370824
NANO-Antivirus	Trojan.Win32.Razy.iwszjl
MicroWorld-eScan	Gen:Variant.Razy.370824
Tencent	Win32.Trojan-qqpass.Qqrob.Llqw
Ad-Aware	Gen:Variant.Razy.370824
Sophos	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZemsilF.34266.tm0@a0@ZKUai
McAfee-GW-Edition	GenericRXHA-SY!A65A93BA771C
FireEye	Generic.mg.a65a93ba771c44dc
Emsisoft	Gen:Variant.Razy.370824 (B)
Avira	HEUR/AGEN.1106080
Antiy-AVL	Trojan/Generic.ASMalwS.27298C1
Microsoft	Trojan:Win32/Occamy.C
GData	Gen:Variant.Razy.370824
McAfee	GenericRXHA-SY!A65A93BA771C
MAX	malware (ai score=100)
VBA32	TrojanPSW.Agent
Panda	Trj/GdSda.A
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/Agent.SSK!tr
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml

How to remove Razy.370824?

Razy.370824 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X