Categories: Malware

How to remove “Razy.551249”?

The Razy.551249 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.551249 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Razy.551249?


File Info:
name: 853917941AF3F7B517A2.mlwpath: /opt/CAPEv2/storage/binaries/5a5385d92cc345ae16bdde87b983336041e7356e8ded0ea900b170aa479f7329crc32: 22257AC4md5: 853917941af3f7b517a2ef783d452347sha1: 38b2693013ac1e53b527344d199608dac87d556dsha256: 5a5385d92cc345ae16bdde87b983336041e7356e8ded0ea900b170aa479f7329sha512: d3f07dd160af4c2f90317bacbfb8d160aa9b265608eb3a9064d60470c8064f91805ad7bf02421e6a93a0ca3639ac4a36ca31689cee403b3849af1665db5f5db4ssdeep: 6144:rF/KrQudjjZ1cR3ATgkgZGdKspOuGDM1KUtBrZoh1aV6Q:rF/UQudjjZ1cR3AT5gugbMKyrr6Qtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T15A14F1123EABDDE1D027CE3C6967D2B90538DEA8CE82660676D86E45FCA11C04FD44A6sha3_384: 12df2553076cab872a6502036e4906c643147d7b8023747265adc2211c12edaa848904befa35aca3c0896032b6adbda3ep_bytes: 833defd04200fd8b05f0d0420085c074timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Razy.551249 also known as:

Bkav	W32.AIDetect.malware2
Lionic	Hacktool.Win32.ArchSMS.3!c
Elastic	malicious (high confidence)
DrWeb	Trojan.SMSSend.2363
MicroWorld-eScan	Gen:Variant.Razy.551249
FireEye	Generic.mg.853917941af3f7b5
CAT-QuickHeal	Trojan.Kanots.A
McAfee	PWS-Zbot.gen.ael
Cylance	Unsafe
Zillya	Trojan.ArchSMS.Win32.33229
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 7000000f1 )
Alibaba	TrojanPSW:Win32/ArchSMS.31c5b150
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.41af3f
BitDefenderTheta	Gen:NN.ZexaF.34212.mGX@aSICpwik
VirIT	Trojan.Win32.SMSSend.DMX
Cyren	W32/Trojan.CCU.gen!Eldorado
Symantec	Packed.Generic.382
ESET-NOD32	Win32/Spy.Zbot.YW
ClamAV	Win.Trojan.Zbot-58757
Kaspersky	HEUR:Hoax.Win32.ArchSMS.heur
BitDefender	Gen:Variant.Razy.551249
NANO-Antivirus	Trojan.Win32.SmsSend.cbobaq
SUPERAntiSpyware	Trojan.Agent/Gen-Zbot
Avast	Win32:Susn-AU [Trj]
Tencent	Malware.Win32.Gencirc.10c42e1c
Ad-Aware	Gen:Variant.Razy.551249
TACHYON	Trojan-Spy/W32.ZBot.197633
Emsisoft	Gen:Variant.Razy.551249 (B)
Comodo	ApplicUnwnt.Win32.Hoax.ArchSMS.SIE@4p73hg
Baidu	Win32.Virus.Krap.a
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.ch
Sophos	Mal/Generic-R + Mal/EncPk-AEH
Ikarus	Trojan-Downloader.Win32.CodecPack
Jiangmin	Worm/Kolab.lyp
eGambit	Unsafe.AI_Score_95%
Avira	TR/Drop.Flux.B
Antiy-AVL	Trojan/Generic.ASMalwS.170A95
Microsoft	PWS:Win32/Zbot!CI
GData	Gen:Variant.Razy.551249
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Zbot.R27310
Acronis	suspicious
VBA32	TScope.Malware-Cryptor.SB
ALYac	Gen:Variant.Razy.551249
MAX	malware (ai score=100)
Malwarebytes	MachineLearning/Anomalous.100%
APEX	Malicious
Rising	Spyware.Voltar!1.AF1D (CLOUD)
Yandex	Trojan.GenAsa!BjtHSrs9Z5c
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Zbot.EQPB!tr
Webroot	W32.InfoStealer.Zeus
AVG	Win32:Susn-AU [Trj]
Panda	Trj/Pacrypt.D
CrowdStrike	win/malicious_confidence_100% (D)