Razy.671714 information

The Razy.671714 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.671714 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Razy.671714?

File Info:
name: 1FF2177B3F65E776A53F.mlw
path: /opt/CAPEv2/storage/binaries/b967e9dc33be88df03c65f279781bd661181757ddc26077c96f192c6d7613879
crc32: 25462067
md5: 1ff2177b3f65e776a53f34d3d18e1acf
sha1: dc23aefb59a53da90d7e1b3593b01b7866c71863
sha256: b967e9dc33be88df03c65f279781bd661181757ddc26077c96f192c6d7613879
sha512: 28f02a3ac95ff13312f15d90e145f31f0f6638ae63a0ed290ab66f4c030619a66e5ffb21946852339f44e51efbca0951f36eef0bf9ad3fc6365ec429230b70f0
ssdeep: 24576:NqNICyDdGLIzNaxexgEQ6qyHZBLhiXzllK7XV9vp:NqNYk0zIxeqEQ6qy5BLhi+Dv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12925236A55B4A145D91D023E083BCDB400CAFD31653BCAAB3AF1B9FDB4F62524D3B906
sha3_384: 7bedc89fcf59d3eae06dc25f0e8940601c48a0e37fbacc9a5700abed26822df8cc3f64759486ad1acaae1d060af10625
ep_bytes: 60be003049008dbe00e0f6ffc78730f7
timestamp: 2021-12-03 11:51:59

Version Info:
FileVersion: 29.9.0.0
Comments: Утилита с параметрами командной строки
LegalCopyright: Copyright (c) 2012-2021 Averin Andrey
Version: 29.9.0.0
Build: 03.12.2021
Coded by: Averin Andrey
Compile date: 3 December 2021 'г.' 14:52:01
CompanyName: Averin Andrey http://tc-image.3dn.ru
InternalName: TCIMG.exe
CompiledScript: 3.3.15.4
Translation: 0x0419 0x04b0

Razy.671714 also known as:

How to remove Razy.671714?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.