Categories: Malware

What is “Razy.699581”?

The Razy.699581 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Razy.699581 virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (5 unique times)
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Steals private information from local Internet browsers
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
www.ipcode.pw
a.tomx.xyz
iplogger.org
apps.identrust.com
isrg.trustid.ocsp.identrust.com
crl.identrust.com
ocsp.int-x3.letsencrypt.org
www.asdgain.xyz

How to determine Razy.699581?


File Info:

crc32: C836CE31md5: 148eb56c204b9b9e1843472e51c909d8name: tmpzju7zauvsha1: 6f120723ebaa3af03fce8e59d7439f29e1489b55sha256: 45bfb2f9a906eea42cb46ceade7a4225b8ea64e007da77bf9d5c64d26483564bsha512: 51985d7df45fd0b37bd4e2a6a797bcfc861f770e97046857cd5b5ab5c143c60c14193c2506a8ce75996ce87a85853e9dedf31ecc1928dbf6a849a4d21b56e575ssdeep: 24576:+yIsS2rKZlgXuAyehDU1/u68XIMveE07MVxdD1u:+yIdUOKXP2PMVxdDAtype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: FileVersion: CompanyName: Comments: This installation was built with Inno Setup.ProductName: searzar ProductVersion: 20.06 FileDescription: searzar Setup Translation: 0x0000 0x04b0

Razy.699581 also known as:

MicroWorld-eScan Gen:Variant.Razy.699581
FireEye Gen:Variant.Razy.699581
Cylance Unsafe
K7AntiVirus Spyware ( 005484541 )
BitDefender Gen:Variant.Razy.699581
K7GW Spyware ( 005484541 )
CrowdStrike win/malicious_confidence_80% (D)
BitDefenderTheta Gen:NN.ZexaF.34130.FmLfaCsIIsgj
Symantec Trojan.Gen.2
Kaspersky HEUR:Trojan-PSW.Win32.Disbuk.gen
Alibaba TrojanSpy:Win32/Socelars.229feb4b
AegisLab Trojan.Win32.Disbuk.i!c
Rising Stealer.Socelars!1.BC83 (CLOUD)
Sophos Mal/Generic-S
Comodo Malware@#gdyptjn33lzz
F-Secure Trojan.TR/AD.DisSteal.cqc
McAfee-GW-Edition BehavesLike.Win32.AdwareFileTour.bc
Emsisoft Gen:Variant.Razy.699581 (B)
Ikarus Trojan-Spy.Agent
Cyren W32/Ransom.AYWE-5242
Webroot W32.Trojan.Gen
Avira TR/AD.DisSteal.cqc
Fortinet W32/Disbuk.S!tr.pws
Endgame malicious (high confidence)
Arcabit Trojan.Razy.DAACBD
ZoneAlarm HEUR:Trojan-PSW.Win32.Disbuk.gen
Microsoft Trojan:Win32/Ymacco.AA2A
AhnLab-V3 Malware/Win32.RL_Generic.R339916
McAfee Artemis!148EB56C204B
MAX malware (ai score=80)
VBA32 TrojanPSW.Disbuk
Malwarebytes Spyware.PasswordStealer
APEX Malicious
ESET-NOD32 a variant of Win32/Spy.Socelars.S
Tencent Win32.Trojan-qqpass.Qqrob.Dxni
GData Gen:Variant.Razy.699581
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.c204b9
Avast Win32:PWSX-gen [Trj]
Qihoo-360 Win32/Trojan.PSW.3d5

How to remove Razy.699581?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Should I remove “Malware.AI.3622831725”?

The Malware.AI.3622831725 is considered dangerous by lots of security experts. When this infection is active,…

6 seconds ago

What is “Generic.Dacic.94CCEEA9.A.B2226F8C (B)”?

The Generic.Dacic.94CCEEA9.A.B2226F8C (B) is considered dangerous by lots of security experts. When this infection is…

9 mins ago

What is “Tedy.577368”?

The Tedy.577368 is considered dangerous by lots of security experts. When this infection is active,…

15 mins ago

MSIL/TrojanDownloader.Agent.QRC removal tips

The MSIL/TrojanDownloader.Agent.QRC is considered dangerous by lots of security experts. When this infection is active,…

16 mins ago

Generic.Dacic.94CCEEA9.A.6E0589A0 (B) information

The Generic.Dacic.94CCEEA9.A.6E0589A0 (B) is considered dangerous by lots of security experts. When this infection is…

1 hour ago

How to remove “Malware.AI.1414244178”?

The Malware.AI.1414244178 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago