Malware

How to remove “Razy.731479 (B)”?

Malware Removal

The Razy.731479 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Razy.731479 (B) virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • A process created a hidden window
  • Uses Windows utilities for basic functionality
  • Exhibits behavior characteristic of Cerber ransomware
  • Attempts to execute a binary from a dead or sinkholed URL
  • Writes a potential ransom message to disk
  • Attempts to modify proxy settings
  • Attempts to access Bitcoin/ALTCoin wallets
  • Collects information to fingerprint the system
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

How to determine Razy.731479 (B)?



File Info:

crc32: 23184527
md5: a73ad1e74dad79665c6714283860368a
name: A73AD1E74DAD79665C6714283860368A.mlw
sha1: 9088f212533af652c7c7cf438294089fb72fb5b4
sha256: 5a85e53723f67e2d30d2a60bcaac3f628951da12548008e1ae8753acc1adbffd
sha512: 70ab24ca5225cc5a543d1b3420cce8dc35d93ba27696816d66067ab4599f7036854cef6068c8ae29acfdd6b6145c1df487d3d1740efb15749c23521de028aca3
ssdeep: 6144:ZRKZl30feXONU/8uu4UqVta/CnXOxHQSC9ihBFtHmZ3+kGEQNbnfKdr3Xkef0f:vKYWnD1UqvFMHQx8iZ3kL7yr3Uhf
type: PE32 executable (GUI) Intel 80386, for MS Windows


Version Info:

LegalCopyright: Copyright xa9 2006-2010 Christian Ghisler
InternalName: Totalcmd-udmin
FileVersion: 1, 0, 0, 5
CompanyName: Ghisler Software GmbH
ecialBuild: D
ivateBuild: j%x01ProductName
LegalTrademarks: Nx13x01OriginalFilename
Comments: Tool used internally by Total Commander, do not start directly!
FileDescription: Total Commander udministrator Tool
0, 0, 5:  
sler Software GmbH Totalcmd-udmin: :x0bx01ProductVersion
alcmd-udmin.exe:  
Translation: 0x0409 0x0000

Razy.731479 (B) also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 005224381 )
Elasticmalicious (high confidence)
DrWebTrojan.Encoder.4691
CynetMalicious (score: 100)
CAT-QuickHealRansom.Cerber.A4
ALYacGen:Variant.Razy.731479
CylanceUnsafe
ZillyaTrojan.Zerber.Win32.2381
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaRansom:Win32/Cerber.ali1020013
K7GWTrojan ( 0050aabe1 )
Cybereasonmalicious.74dad7
BaiduWin32.Trojan.Kryptik.alb
CyrenW32/Cerber.F.gen!Eldorado
SymantecPacked.Generic.459
ESET-NOD32a variant of Win32/Kryptik.FQRH
APEXMalicious
AvastWin32:Filecoder-BG [Trj]
ClamAVWin.Ransomware.Razy-7350762-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Razy.731479
NANO-AntivirusTrojan.Win32.Zerber.eoegxc
SUPERAntiSpywareRansom.Cerber/Variant
MicroWorld-eScanGen:Variant.Razy.731479
TencentMalware.Win32.Gencirc.10bb6451
Ad-AwareGen:Variant.Razy.731479
SophosML/PE-A + Mal/Cerber-B
ComodoTrojWare.Win32.Ransom.Cerber.BP@6xmdf4
BitDefenderThetaGen:NN.ZexaF.34628.Pq2@ae2MhCF
VIPRETrojan.Win32.Generic.pak!cobra
TrendMicroRansom_HPCERBER.SMALY5A
McAfee-GW-EditionBehavesLike.Win32.PinkSbot.jm
FireEyeGeneric.mg.a73ad1e74dad7966
EmsisoftGen:Variant.Razy.731479 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Generic.ghscz
WebrootTrojan.Dropper.Gen
AviraTR/Crypt.ZPACK.Gen7
eGambitUnsafe.AI_Score_99%
MicrosoftRansom:Win32/Cerber.J
ArcabitTrojan.Razy.DB2957
AegisLabTrojan.Win32.Zerber.j!c
GDataGen:Variant.Razy.731479
AhnLab-V3Win-Trojan/Cerber.Gen
Acronissuspicious
McAfeeRansomware-CBER!A73AD1E74DAD
MAXmalware (ai score=80)
VBA32BScope.TrojanSpy.Zbot
MalwarebytesCerber.Ransom.Encrypt.DDS
PandaTrj/Genetic.gen
TrendMicro-HouseCallRansom_HPCERBER.SMALY5A
RisingTrojan.Kryptik!1.AACA (CLOUD)
YandexTrojan.GenAsa!B5hGkS/uEBQ
IkarusTrojan-Ransom.Cerber
FortinetW32/Kryptik.HJJV!tr
AVGWin32:Filecoder-BG [Trj]
Qihoo-360Win32/Trojan.6f1

How to remove Razy.731479 (B)?

Razy.731479 (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment