Razy.488739 malicious file

The Razy.488739 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.488739 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Uses Windows utilities for basic functionality
• Sniffs keystrokes
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Creates known Njrat/Bladabindi RAT registry keys

How to determine Razy.488739?

File Info:
name: 576014AB03BCDC66610B.mlw
path: /opt/CAPEv2/storage/binaries/a51ba151f3cb7cd87768072b98ea0d7f4605963531a895fb4fd01fec9c31b3e3
crc32: 14ED4435
md5: 576014ab03bcdc66610ba66015cbabb2
sha1: 639e571a51b87868730576093e3bc590934d4487
sha256: a51ba151f3cb7cd87768072b98ea0d7f4605963531a895fb4fd01fec9c31b3e3
sha512: f5a9753c278ccc88f4781d7ebe75de3d86c3c87b9322aff94ec0e29e8c733c22af2286ad8b672d07858667614ae11a742631c8754184ea82f0ba92ce6360ff05
ssdeep: 3072:FQez0iVD43ZfbnTjaixZxWAvSQvgKhs5ThWgHtoTOAj:FQeOZrT0AvSBKhs
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B5B38C4AFFD46B3BD0395533886254BE42E5DFAB2705EF0FA5F453380AA63EC4286059
sha3_384: 6a872f1ea26a44804424108fcbd324a4815c9b780751e476635bbf421bfba86ef73b125bbacaebbb2f37b05c6d3e5be1
ep_bytes: ff250020400000000000000000000000
timestamp: 2018-04-07 13:26:54

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: csrss.exe
LegalCopyright:  
OriginalFilename: csrss.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Razy.488739 also known as:

How to remove Razy.488739?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.