About "Razy.731479" infection

The Razy.731479 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.731479 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
A process created a hidden window
Creates an excessive number of UDP connection attempts to external IP addresses
Performs some HTTP requests
Uses Windows utilities for basic functionality
Exhibits behavior characteristic of Cerber ransomware
Attempts to execute a binary from a dead or sinkholed URL
Writes a potential ransom message to disk
EternalBlue behavior
Attempts to modify proxy settings
Attempts to access Bitcoin/ALTCoin wallets
Generates some ICMP traffic
Collects information to fingerprint the system
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

api.blockcypher.com

hjhqmbxyinislkkt.1j9r76.top

How to determine Razy.731479?


File Info:
crc32: F8A15A91
md5: dd118c157723214f300de222c6c0b40c
name: DD118C157723214F300DE222C6C0B40C.mlw
sha1: 70ac57b12feac6e6147bef3f6cc836aab67359aa
sha256: f1e3896a693a7c5f89d86f19649b16d1f2c2161c46936526b1a14f0e9dcf66d9
sha512: 7d45f220b5b32ef1b7fe24cc27c61bac4093ea82fb8853d8a0220a4dc6be039cebd3192732415f8989570a0d057c2429865577f4f5476f5fdce3e4401a98c10f
ssdeep: 6144:R8KZl30feXONU/8uu4UqVta/CnXOxHQSUihBFtHmZ3+kGEQNbuSdN3Xkefv:WKYWnD1UqvFMHQciZ3kL1N3Um
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2006-2010 Christian Ghisler
InternalName: Totalcmd-udmin
FileVersion: 1, 0, 0, 5
CompanyName: Ghisler Software GmbH
ecialBuild: D
ivateBuild: j%x01ProductName
LegalTrademarks: Nx13x01OriginalFilename
Comments: Tool used internally by Total Commander, do not start directly!
FileDescription: Total Commander udministrator Tool
0, 0, 5:  
sler Software GmbH Totalcmd-udmin: :x0bx01ProductVersion
alcmd-udmin.exe:  
Translation: 0x0409 0x0000

Razy.731479 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.4691
MicroWorld-eScan	Gen:Variant.Razy.731479
FireEye	Generic.mg.dd118c157723214f
CAT-QuickHeal	Ransom.Cerber.A4
ALYac	Gen:Variant.Razy.731479
Cylance	Unsafe
Zillya	Trojan.Zerber.Win32.1910
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005224381 )
BitDefender	Gen:Variant.Razy.731479
K7GW	Trojan ( 0050aabe1 )
Cybereason	malicious.577232
BitDefenderTheta	Gen:NN.ZexaF.34590.Pq2@aW!SgGE
Cyren	W32/Cerber.F.gen!Eldorado
Symantec	Packed.Generic.459
TrendMicro-HouseCall	Ransom_HPCERBER.SMALY5A
Avast	Win32:Filecoder-BG [Trj]
ClamAV	Win.Ransomware.Razy-7350762-0
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Kryptik.eonuwn
Ad-Aware	Gen:Variant.Razy.731479
Emsisoft	Gen:Variant.Razy.731479 (B)
Comodo	TrojWare.Win32.Ransom.Cerber.BP@6xmdf4
F-Secure	Trojan.TR/Crypt.ZPACK.Gen7
Baidu	Win32.Trojan.Kryptik.alb
VIPRE	Trojan.Win32.Generic.pak!cobra
TrendMicro	Ransom_HPCERBER.SMALY5A
McAfee-GW-Edition	BehavesLike.Win32.PinkSbot.jm
SentinelOne	Static AI – Malicious PE
Sophos	ML/PE-A + Mal/Cerber-B
Ikarus	Trojan-Ransom.Cerber
Jiangmin	Trojan.Generic.gcysb
Avira	TR/Crypt.ZPACK.Gen7
Antiy-AVL	Trojan/Win32.TSGeneric
Microsoft	Ransom:Win32/Cerber
Arcabit	Trojan.Razy.DB2957
SUPERAntiSpyware	Ransom.Cerber/Variant
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Razy.731479
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Cerber.Gen
Acronis	suspicious
McAfee	Ransomware-CBER!DD118C157723
MAX	malware (ai score=87)
VBA32	BScope.TrojanSpy.Zbot
Malwarebytes	Cerber.Ransom.Encrypt.DDS
Panda	Trj/Genetic.gen
APEX	Malicious
ESET-NOD32	a variant of Win32/Kryptik.FQRH
Rising	Trojan.Kryptik!1.AACA (RDMK:cmRtazqRzx9NB+TIQ5yHSCIPbEPz)
Yandex	Trojan.GenAsa!KgjQsx4pNFA
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Kryptik.HJJV!tr
AVG	Win32:Filecoder-BG [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Trojan.836

How to remove Razy.731479?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Razy.731479” infection