About “Razy.712308” infection

The Razy.712308 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.712308 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Razy.712308?

File Info:
name: A5BD72E9F6F97AC3A075.mlw
path: /opt/CAPEv2/storage/binaries/9babc798e91cf0ad1f9a355137cfcd70bdb28480a7d18075629d2b144d15b03b
crc32: D7DE2C7D
md5: a5bd72e9f6f97ac3a0750699d3432e90
sha1: 5bbe9841a8f30f8240b4d6cbb2b50773e98e9e4d
sha256: 9babc798e91cf0ad1f9a355137cfcd70bdb28480a7d18075629d2b144d15b03b
sha512: 9fcc113674e2080964f6b24b032b84ba29a59632823559e2e85c8931d472baa13e84769700c323a5d95d844ebc421921ce2e4522779936d0f1f9410254d88aea
ssdeep: 3072:1itn1K57HjhQn2wD4VBEIGumnSnMtvyoRLHDB/eR9jaO3OZvH8OU2YFLhNL9bD3f:e1gjS4FcSnoya3oWXzY1LRKtEFx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1155423D1966030D5EC7344BC5BBAAD337ABCBEA0650085BF27824F9161C9659A331BCE
sha3_384: a8e443e218c50c207f0928b9585d72d068c8f73d513adf5c397f878e7c330e94cd9a77b104bb60b11f2b6fd030ff3189
ep_bytes: 558bec81ecf0000000eb2b83f9aa7426
timestamp: 2012-11-25 13:23:43

Version Info:
LegalCopyright: gipsggnhnb vzjowxr blskwgja ctvep
ProductName: zoxsr nedsf dyrlx nhtfsadlo
InternalName: igxjyxr qmzw
CompanyName: Sysinternals - www.sysinternals.com
ProductVersion: 48.154.40887
Translation: 0x0409 0x04b0

Razy.712308 also known as:

How to remove Razy.712308?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.