Razy.427937 removal guide

The Razy.427937 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.427937 virus can do?

At least one process apparently crashed during execution
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Razy.427937?


File Info:
name: A30B21BE9DFD0F600678.mlw
path: /opt/CAPEv2/storage/binaries/d9acc702bda35bfd15adb125dc828cb58c162d2eae62eadbd911984cc1cc7e25
crc32: 38EC3C4A
md5: a30b21be9dfd0f60067867449e6f0a32
sha1: 5520d7626ad958d1f705451b6b50e35edba781d9
sha256: d9acc702bda35bfd15adb125dc828cb58c162d2eae62eadbd911984cc1cc7e25
sha512: e0518e931b0d15e0d0faa1873efdc0acada302ba6a9aad03ce92f025b893c5a736fb456a57adec1262c5dd1cdd20d5fcb4d559e3add9fadd77c7474254b1bebc
ssdeep: 12288:RAjuakTOfDlEU4HWDblFlOTPTPNdGErpHGLB:au/OfDlEUKWflmTPxdGepHGt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DCE45D3365944072E6F10177BF289630BE6CAF381754886EF3D4BE1D2AB849167B7293
sha3_384: 87c29a45096e8465bf51b5d7192e3dc5b950c577a4bab6be5e7ed3fae9c637c749f3725b325cd7729f99f3b271bdc9ae
ep_bytes: 99999e91989b98929e9b9e91fd9e9999
timestamp: 2017-11-18 22:00:38

Version Info:
CompanyName: Python Software Foundation
FileDescription: Python 3.10.0 (64-bit)
FileVersion: 3.10.150.0
InternalName: setup
LegalCopyright: Copyright (c) Python Software Foundation. All rights reserved.
OriginalFilename: python-3.10.0-amd64.exe
ProductName: Python 3.10.0 (64-bit)
ProductVersion: 3.10.150.0
Translation: 0x0409 0x04e4

Razy.427937 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.427937
ALYac	Gen:Variant.Razy.427937
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZexaF.34062.OO0@aiychtci
Symantec	ML.Attribute.HighConfidence
BitDefender	Gen:Variant.Razy.427937
Avast	Win32:JunkPoly [Cryp]
Ad-Aware	Gen:Variant.Razy.427937
Emsisoft	Gen:Variant.Razy.427937 (B)
FireEye	Generic.mg.a30b21be9dfd0f60
GData	Gen:Variant.Razy.427937
Avira	HEUR/AGEN.1125351
Arcabit	Trojan.Razy.D687A1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
MAX	malware (ai score=81)
APEX	Malicious
Rising	Malware.Heuristic!ET#90% (RDMK:cmRtazo7U2nI8p165VTkxPEnSc48)
SentinelOne	Static AI – Malicious PE
AVG	Win32:JunkPoly [Cryp]
Cybereason	malicious.e9dfd0

How to remove Razy.427937?

Razy.427937 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X