Categories: Malware

Razy.596177 (B) (file analysis)

The Razy.596177 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.596177 (B) virus can do?

Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
.NET file is packed/obfuscated with SmartAssembly
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Razy.596177 (B)?


File Info:
name: CBCB8A500520EBAB7079.mlwpath: /opt/CAPEv2/storage/binaries/0c6565c2bc7395b4567777fd5ab58f4c3a999eb630d253a63d1cc60cdf1a231acrc32: 987FE6DFmd5: cbcb8a500520ebab7079384ca83ba9fdsha1: 3b99072cf55802936263099e1bda4320357c1d02sha256: 0c6565c2bc7395b4567777fd5ab58f4c3a999eb630d253a63d1cc60cdf1a231asha512: 31df3087cb222af2d31eb7d70cf16296edd8ef2af6545064d178c2aad1a7ed2f60d17630c0d569f62664da730733faa14339c170789d853bb614bf356ab8f173ssdeep: 49152:CcQ9rcQqDMo3vigZzSyxSZTu98OT2Y1n6VffwGULGIYm3a4N:hQtcbDMoffHAF016ePLGIz3aWtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E8C52398B7C25815D13F02B985E115335B749672D28AF70F9E889DC82CD23DF825B2EBsha3_384: 69bf8bb93616fac1065eede458b235df122e5f8788a83593156ae3990393e5c2558b63fd66fa38ea570c6b53ab21b2c1ep_bytes: ff256ce3410000005f436f724578654dtimestamp: 2022-07-29 04:58:09
Version Info:
Translation: 0x0000 0x04b0FileDescription: dasdasdFileVersion: 1.0.0.0InternalName: force.exeLegalCopyright: dasdasdOriginalFilename: force.exeProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Razy.596177 (B) also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.m4GG
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Razy.596177
ClamAV	Win.Packed.Ursu-7334536-0
FireEye	Generic.mg.cbcb8a500520ebab
McAfee	PWS-FAVY!CBCB8A500520
Cylance	Unsafe
VIPRE	Gen:Variant.Razy.596177
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 004e37a91 )
Alibaba	Backdoor:MSIL/NanoBot.91b1dc85
K7GW	Trojan ( 004e37a91 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/MSIL_Kryptik.ALG.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Injector.ECH
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.NanoBot.gen
BitDefender	Gen:Variant.Razy.596177
NANO-Antivirus	Trojan.Win32.MLW.dwyhve
Avast	MSIL:BFBot-A [Cryp]
Tencent	Msil.Backdoor.Nanobot.Bdhl
Ad-Aware	Gen:Variant.Razy.596177
Emsisoft	Gen:Variant.Razy.596177 (B)
F-Secure	Trojan.TR/Dropper.MSIL.Gen2
DrWeb	Trojan.DownLoader24.62400
Zillya	Trojan.Injector.Win32.1574087
TrendMicro	TROJ_GEN.R002C0PGT22
McAfee-GW-Edition	PWS-FAVY!CBCB8A500520
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-R + Troj/MSIL-QP
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Razy.596177
Jiangmin	Backdoor.MSIL.fucg
Webroot	W32.Malware.gen
Avira	TR/Dropper.MSIL.Gen2
MAX	malware (ai score=89)
Antiy-AVL	Trojan/MSIL.Injector
Arcabit	Trojan.Razy.D918D1
ZoneAlarm	HEUR:Backdoor.MSIL.NanoBot.gen
Microsoft	Backdoor:Win32/Bladabindi!ml
Google	Detected
AhnLab-V3	Malware/Win32.Generic.R134785
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.34646.Bo0@ay5ig7j
ALYac	Gen:Variant.Razy.596177
Malwarebytes	Backdoor.Bot
TrendMicro-HouseCall	TROJ_GEN.R002C0PGT22
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:FUug7pLtHfx+jjA/sgXUQA)
Ikarus	Trojan.MSIL.Injector
MaxSecure	Trojan.Malware.73691366.susgen
Fortinet	MSIL/StubRC.AVB!tr
AVG	MSIL:BFBot-A [Cryp]
Panda	Trj/GdSda.A