Razy.460159 (B) (file analysis)

The Razy.460159 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.460159 (B) virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Razy.460159 (B)?


File Info:
name: 4EC52221E789AA65DF42.mlw
path: /opt/CAPEv2/storage/binaries/94b177d57d5fd99a2b6cbd70e5fd00800d91b78e75232942fcf6633d643419d0
crc32: DB40FEAF
md5: 4ec52221e789aa65df42476317665c67
sha1: 36a2ec0b81b1b92900fb925c966ad09b40d7933d
sha256: 94b177d57d5fd99a2b6cbd70e5fd00800d91b78e75232942fcf6633d643419d0
sha512: 5301a2d3df32c4339a17f8f44692bf3369067bef2ce47e2138eb0b91ac2678f80ce4eb51678e7a75c9c50abf1689bcdc0905cc28b20e3fe9ab98c45e24863285
ssdeep: 49152:5kxOm+7TjsPnztyDMYcFvLYUFNxuUM2jNf:5JotyDUvLYqNxrNf
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1C4757C5A33684D9AEE62E17A8A11C23BD6B07D461536871F00F05DB7FE336B21E2D361
sha3_384: a9db7e319c686426dc08b97c90957522ed390f513b5ec7718dfd093d702b61c47cc512540d283c996efc89a56f0c0baa
ep_bytes: 4883ec28e8bfb300004883c428e936fe
timestamp: 2021-07-07 07:39:21

Version Info:
FileVersion: 3.3.14.5
Comments: Blackbunny Unattendeds ©2021
FileDescription: Blackbunny Unattendeds ©2021
ProductVersion: 3.3.14.5
LegalCopyright: © Eaglesteam 2014
Translation: 0x0413 0x04b0

Razy.460159 (B) also known as:

Lionic	Trojan.Win32.Cometer.4!c
MicroWorld-eScan	Gen:Variant.Razy.460159
McAfee	Artemis!4EC52221E789
Cylance	Unsafe
BitDefender	Gen:Variant.Razy.460159
Cyren	W32/Trojan.VGQM-0334
APEX	Malicious
Kaspersky	UDS:Trojan.Win32.Cometer.gen
Alibaba	Trojan:Win32/Cometer.8b39be06
Ad-Aware	Gen:Variant.Razy.460159
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1143820
TrendMicro	TROJ_GEN.R002C0WJ821
McAfee-GW-Edition	BehavesLike.Win64.PUP.th
FireEye	Generic.mg.4ec52221e789aa65
Emsisoft	Gen:Variant.Razy.460159 (B)
GData	Gen:Variant.Razy.460159
Avira	HEUR/AGEN.1143820
Arcabit	Trojan.Razy.D7057F
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win64.Generic.C3418159
ALYac	Gen:Variant.Razy.460159
MAX	malware (ai score=87)
VBA32	Trojan.Cometer
Malwarebytes	HackTool.Cracker
TrendMicro-HouseCall	TROJ_GEN.R002C0WJ821
Tencent	Win32.Trojan.Cometer.Phqr
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Cybereason	malicious.1e789a
Avast	Win32:Malware-gen
MaxSecure	Trojan.Malware.10056239.susgen

How to remove Razy.460159 (B)?

Razy.460159 (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X