What is “Razy.477389”?

The Razy.477389 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.477389 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Anomalous .NET characteristics
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• A script process created a new process
• CAPE detected the BlackshadesRAT malware family
• Attempts to masquerade or mimic a legitimate process or file name

How to determine Razy.477389?

File Info:
name: 8CB4DB6AF79FFBA3538F.mlw
path: /opt/CAPEv2/storage/binaries/6416a569fdb34fee3d6ce92f61ee956ed3e9d0b61ecf9fc3bb3b86d023816af3
crc32: A822A236
md5: 8cb4db6af79ffba3538ff531c6145e7c
sha1: 52a7a5a0731f386dda2445816ad2be9ab0f22c25
sha256: 6416a569fdb34fee3d6ce92f61ee956ed3e9d0b61ecf9fc3bb3b86d023816af3
sha512: 9b60ec7bb67ddfa675e5fa435319db29901624034f9b53136a6626ab248ee47ba29b97d7c3a1b7649fa0b6b332c4f26e5f95eb68b0109b58869e2a3a599db8a3
ssdeep: 24576:3qfl3GrBbMDmZEBGtj+0cNVQOjHVOUr222qB1s:3g4pzhB1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FC75492439FA501AB173EFAA8BE479EADA6FB7733B07645D109003864723941DEC153E
sha3_384: 5c621776d330ce6ba0b029b6dc3fb79930f9c3485148be9647cb5e8dff45be05658295b9cf37dd85fafc21ed77c954aa
ep_bytes: ff250020400000000000000000000000
timestamp: 2011-02-20 03:38:12

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: autorun2.exe
LegalCopyright:  
OriginalFilename: autorun2.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Razy.477389 also known as:

How to remove Razy.477389?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.