Categories: Malware

Razy.594846 removal tips

The Razy.594846 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.594846 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Unconventionial language used in binary resources: Korean
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Razy.594846?


File Info:
name: 61157D2CA35CA8700009.mlwpath: /opt/CAPEv2/storage/binaries/c3c427f76add9ca5e59ff6296a54ab232c1674e2bd31e80d10d4504cb2f34618crc32: 513E8729md5: 61157d2ca35ca870000923dfe1bff98dsha1: 0a0b8ef2b3f6bd5ad7cce17165d52568f230faa4sha256: c3c427f76add9ca5e59ff6296a54ab232c1674e2bd31e80d10d4504cb2f34618sha512: cb257f1527739a6018d106258d47d33ef67173ad8dc4ae33ecff50569602a040a244d1d80b8f49ef9fa79add5b685d3b907e0711fed39a540edd14bc25f449b0ssdeep: 384:s1K3yL2pQnVDFO57S5S+PNko/IcqHx4onc9niOu9Io61BhwFY/bmkekE5W1HTbvb:sHiaDk76SoAXRTcVPK61vRp1753S1Oa2type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E3F2E1C497BDB156D6BE2A700093E6128FD8FD22F73E817B6E6037897A14B208611B90sha3_384: 39fb223bded996298fe6d45b1d89393917ec3e10f1acbc483b71a2391ace30d73fdb7d3ff4ca18089b052e476df7c1b7ep_bytes: 60be006040008dbe00b0ffff5783cdfftimestamp: 2007-09-05 15:33:49
Version Info:
Comments: CompanyName: FileDescription: dawa MFC 응용 프로그램FileVersion: 1, 0, 0, 1InternalName: dawaLegalCopyright: Copyright (C) 2007LegalTrademarks: OriginalFilename: dawa.EXEPrivateBuild: ProductName: dawa 응용 프로그램ProductVersion: 1, 0, 0, 1SpecialBuild: Translation: 0x0412 0x04b0

Razy.594846 also known as:

Lionic	Trojan.Win32.Agent.b!c
MicroWorld-eScan	Gen:Variant.Razy.594846
FireEye	Generic.mg.61157d2ca35ca870
McAfee	GenericRXAA-AA!61157D2CA35C
VIPRE	Gen:Variant.Razy.594846
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.ca35ca
Cyren	W32/Virut.AI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Razy.594846
Avast	Win32:Patched-AFR [Trj]
Tencent	Win32.Trojan-Dropper.Agent.bktx
Ad-Aware	Gen:Variant.Razy.594846
Sophos	Generic ML PUA (PUA)
Comodo	Malware@#p2qefn64yooj
DrWeb	Trojan.MulDrop2.32274
Zillya	Dropper.Agent.Win32.99432
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Razy.594846 (B)
GData	Gen:Variant.Razy.594846
Jiangmin	TrojanDropper.Agent.ayqg
Avira	TR/Crypt.ULPM.Gen
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Generic.ASMalwS.3C54
ViRobot	Dropper.Agent.36864.Y
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34592.cmKfa0ndABeG
ALYac	Gen:Variant.Razy.594846
VBA32	BScope.TrojanDownloader.VB
Malwarebytes	Sality.Virus.FileInfector.DDS
Yandex	Trojan.DR.Agent!/nVb+ajDMZw
Ikarus	Virus.Win32.Virut
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.EYDL!tr
AVG	Win32:Patched-AFR [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)