Malware

What is “Razy.584657”?

Malware Removal

The Razy.584657 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Razy.584657 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • Unconventionial binary language: Russian
  • Unconventionial language used in binary resources: Russian
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Attempts to modify proxy settings

Related domains:

wpad.local-net

How to determine Razy.584657?



File Info:

name: DF36ABAFBC337BFD7DD6.mlw
path: /opt/CAPEv2/storage/binaries/87db3fbe66918bbce20564b8ad10481997ca782e99f5f382c97d96ddceee5301
crc32: 41000C50
md5: df36abafbc337bfd7dd6e8ffc277179d
sha1: 6c6c8cc5deee3d502b5ed2435d4eb4a791c3e4b4
sha256: 87db3fbe66918bbce20564b8ad10481997ca782e99f5f382c97d96ddceee5301
sha512: 2dd78cde2560231a6b9deb20d88f4fab97a2807926ace5718888cb65b13351193960c61b0377f5efd78adbf5490af6cdc65b0b4664f7cee6a482ce7d8d002cf1
ssdeep: 3072:lsmHOsrCM/rzkheJX3EjGKj0TVGSHdJc2VmefevBOiqi:l5trBTzk4EjDSVGmdKwu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EE048E03F6908920F5B887702EB98AA5153BBF611B31D1CF2B7A7E9D0970ED09A34757
sha3_384: 16cc154a440ce7646ef523a3995876a44008408edbd49947f711dea45051b82bb961a415f0acacaf3b4e12d50ff7e0f5
ep_bytes: 558bec81ec78090000e8b20c00008985
timestamp: 1970-01-01 15:50:05


Version Info:

CompanyName: Crypto-Pro LLC
FileDescription: Crypto-Pro Setup Application
FileVersion: 5.0.20370.0
InternalName: Setup
LegalCopyright: © Crypto-Pro LLC. All rights reserved.
OriginalFilename: Setup.exe
ProductName: CryptoPro CSP
ProductVersion: 5.0.11455.0
Translation: 0x0409 0x04b0

Razy.584657 also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Razy.584657
FireEyeGeneric.mg.df36abafbc337bfd
ALYacGen:Variant.Razy.584657
CylanceUnsafe
K7AntiVirusTrojan-Downloader ( 00573e531 )
K7GWTrojan-Downloader ( 00573e531 )
Cybereasonmalicious.fbc337
BitDefenderThetaGen:NN.ZexaF.34294.ky2@aaBxSEak
CyrenW32/ZeroDloader.A.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/TrojanDownloader.Agent.EQH
APEXMalicious
KasperskyTrojan.Win32.Patched.rw
BitDefenderGen:Variant.Razy.584657
NANO-AntivirusVirus.Win32.Gen.ccmw
TencentVirus.Win32.Patched.kh
Ad-AwareGen:Variant.Razy.584657
TACHYONWorm/W32.ZeroDownloader
EmsisoftGen:Variant.Razy.584657 (B)
McAfee-GW-EditionBehavesLike.Win32.Infected.ch
SophosMal/Generic-S
IkarusTrojan-Downloader.Win32.Agent
GDataWin32.Trojan.PSE.9TP5PK
JiangminTrojanDownloader.Generic.beop
AviraW32/Infector.Gen
ArcabitTrojan.Razy.D8EBD1
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.RL_Generic.R282625
McAfeeGenericRXIG-TN!DF36ABAFBC33
MAXmalware (ai score=85)
VBA32BScope.TrojanBanker.CliptoShuffler
RisingTrojan.Generic@ML.95 (RDML:OI7AiPlb3fMJPsHReTBhow)
SentinelOneStatic AI – Suspicious PE
FortinetW32/Agent.EQH!tr
AVGWin32:DropperX-gen [Drp]
AvastWin32:DropperX-gen [Drp]
CrowdStrikewin/malicious_confidence_90% (D)

How to remove Razy.584657?

Razy.584657 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment