Malware

About “Razy.468148” infection

Malware Removal

The Razy.468148 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Razy.468148 virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Razy.468148?



File Info:

name: D04EF76403DE98C68F44.mlw
path: /opt/CAPEv2/storage/binaries/1cd937f8ac0c5355463219c6dd6d29fb7c596634aa7006d5ea5f64525c358cfa
crc32: E3B04DFF
md5: d04ef76403de98c68f4479084c58b4e8
sha1: f86d0fb525c47d31a3c008ee8e71625d5265526d
sha256: 1cd937f8ac0c5355463219c6dd6d29fb7c596634aa7006d5ea5f64525c358cfa
sha512: f4904ef27a637db600be602f64168a23cefadbe8066d57df38815b98890136885314d1abbcf93c7edc9943b9c9141af122942907ec96dd58eb9fd508a69bb4c0
ssdeep: 12288:Hyl/7BddB9wDUx9LFKpwuD96cM3ydIcm48T85:HyZdB9w8r7uJ6RTcL8Y
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T13BF4129BB58E71A0E1F5E8B89A91918E45B338B5473243BF3782B31A720D3B2D43C715
sha3_384: 1ed19cfa2b77c57246b647936dcab1038e1caab24b604cd85faa628738056701f405987991a6e357520900c731ee3015
ep_bytes: 4883ec28e8e30600004883c428e91afe
timestamp: 2018-12-11 05:08:22


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Windows System Tweak
FileVersion: 94.71.70.82
InternalName: conhost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: conhost.exe
ProductName: Microsoft© Windows© Operating System
ProductVersion: 22.37.09.09
Translation: 0x0409 0x04b0

Razy.468148 also known as:

LionicTrojan.Win32.Razy.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Razy.468148
FireEyeGeneric.mg.d04ef76403de98c6
McAfeeGeneric.eab
CylanceUnsafe
ZillyaTrojan.Injector.Win64.130
SangforTrojan.Win64.Agent.qwhurz
K7AntiVirusTrojan ( 005410a71 )
AlibabaTrojan:Win64/Injector.f245735d
K7GWTrojan ( 005410a71 )
CrowdStrikewin/malicious_confidence_90% (W)
SymantecTrojan.Gen.2
ESET-NOD32a variant of Win64/Injector.BE
AvastWin64:CoinminerX-gen [Trj]
KasperskyTrojan.Win64.Agent.qwhurz
BitDefenderGen:Variant.Razy.468148
NANO-AntivirusTrojan.Win64.Razy.fofwsg
SUPERAntiSpywareTrojan.Agent/Gen-Dropper
TencentWin64.Trojan.Agent.Wnvy
Ad-AwareGen:Variant.Razy.468148
SophosMal/Generic-S
ComodoMalware@#1lk1c8xsvsaws
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R002C0DGJ21
McAfee-GW-EditionBehavesLike.Win64.Worm.bc
EmsisoftGen:Variant.Razy.468148 (B)
Paloaltogeneric.ml
GDataGen:Variant.Razy.468148
JiangminTrojan.Agent.dkqn
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1144733
Antiy-AVLTrojan/Generic.ASMalwS.29E705A
MicrosoftTrojan:Win64/Injector.CD
CynetMalicious (score: 99)
AhnLab-V3Malware/Gen.Generic.C2835195
ALYacGen:Variant.Razy.468148
MAXmalware (ai score=100)
VBA32Trojan.Win64.Agent
MalwarebytesTrojan.FakeMS.Generic
TrendMicro-HouseCallTROJ_GEN.R002C0DGJ21
YandexTrojan.Injector!5ap2MVhfPGE
FortinetW64/Injector.BE!tr
AVGWin64:CoinminerX-gen [Trj]
Cybereasonmalicious.403de9
PandaTrj/CI.A

How to remove Razy.468148?

Razy.468148 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment