Razy.571245 removal

The Razy.571245 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.571245 virus can do?

Injection (inter-process)
Executable code extraction
Injection with CreateRemoteThread in a remote process
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Expresses interest in specific running processes
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Arabic (Qatar)
A scripting utility was executed
Attempts to remove evidence of file being downloaded from the Internet
Code injection with CreateRemoteThread in a remote process
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself
Attempts to interact with an Alternate Data Stream (ADS)

Related domains:

z.whorecord.xyz

a.tomx.xyz

tonymaris7342.ddns.net

How to determine Razy.571245?


File Info:
crc32: 369D8A9D
md5: 124f8e6f4e33e34e1c503fcbbab07a43
name: 124F8E6F4E33E34E1C503FCBBAB07A43.mlw
sha1: f4e7d9f44bcdb838db38d411db8d7dd0f3dcd9ec
sha256: aa30aefbe46f560c14319213acb2c073d7b851959989b48f0b66bca5800addab
sha512: af6da87afa4ac11b31d67bdd781597a37c86156fa45f57951c233d51b8a6a53b5e6cdd48d6c23a85c761de48a32222bd8fa4b59edc4727daa9d416e73bc2105d
ssdeep: 1536:usRBBlpHXsBM9iDePjxszzuivq9y/y8RDpoB4u0OVE01g:3lll88IHU2z9u0OVE0u
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Razy.571245 also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Maria.3
MicroWorld-eScan	Gen:Variant.Razy.571245
FireEye	Generic.mg.124f8e6f4e33e34e
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Gen:Variant.Razy.571245
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0054d10e1 )
BitDefender	Gen:Variant.Razy.571245
K7GW	Trojan ( 0054d10e1 )
CrowdStrike	win/malicious_confidence_100% (D)
TrendMicro	Trojan.Win32.BYPASSUAC.AA
BitDefenderTheta	Gen:NN.ZexaF.34590.hyW@aC46ikhi
Cyren	W32/Antiav.INDT-0919
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Malware.AveMaria-8799014-1
Kaspersky	Trojan.Win32.Agentb.jiad
NANO-Antivirus	Trojan.Win32.AntiAV.fljpfv
Tencent	Malware.Win32.Gencirc.11b10011
Ad-Aware	Gen:Variant.Razy.571245
Emsisoft	Gen:Variant.Razy.571245 (B)
F-Secure	Trojan.TR/Redcap.ghjpt
Invincea	ML/PE-A + Troj/Agent-AJFK
McAfee-GW-Edition	BehavesLike.Win32.Dropper.ch
Sophos	Troj/Agent-AJFK
Ikarus	Trojan-Spy.Agent
eGambit	Trojan.Generic
Avira	TR/Redcap.ghjpt
Antiy-AVL	Trojan/Win32.SGeneric
Microsoft	Backdoor:Win32/Remcos!MTB
Arcabit	Trojan.Razy.D8B76D
ZoneAlarm	Trojan.Win32.Agentb.jiad
GData	Win32.Backdoor.AveMaria.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.AveMaria.R263895
McAfee	GenericRXAA-AA!124F8E6F4E33
MAX	malware (ai score=82)
Malwarebytes	Backdoor.AveMaria
ESET-NOD32	a variant of Win32/Agent.TJS
TrendMicro-HouseCall	Trojan.Win32.BYPASSUAC.AA
Rising	Stealer.AveMaria!1.BA1C (CLASSIC)
Yandex	Trojan.GenAsa!++8lN4UW0KE
SentinelOne	Static AI – Malicious PE
AVG	Win32:Malware-gen
Cybereason	malicious.f4e33e
Qihoo-360	HEUR/QVM20.1.38DF.Malware.Gen

How to remove Razy.571245?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.