Malware

Razy.734002 information

Malware Removal

The Razy.734002 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Razy.734002 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • Authenticode signature is invalid
  • Created a process from a suspicious location

How to determine Razy.734002?



File Info:

name: 589F1CFC0D28A25C8C98.mlw
path: /opt/CAPEv2/storage/binaries/b9a00ed3d3e3ab041d63a5e0404c9b5b848168f459952bbb0a1adb9224a124a0
crc32: 76693A4B
md5: 589f1cfc0d28a25c8c98c098c5dcae08
sha1: 9af7a46844677155ab2ffa5d2ba87bcdec777f75
sha256: b9a00ed3d3e3ab041d63a5e0404c9b5b848168f459952bbb0a1adb9224a124a0
sha512: 2aa7987fa4e386bc3e6c4deacf26df23e92e898d5e80ad7d6dc73a153fd126a121444a5b0f7f4ff42fa11a5ddcdb5fec8d967c358393b50d420245a4794b0617
ssdeep: 24576:TEBLQ6QkH7/P9DriII9FoGo7AZhBMaBVziB8:TEpTFDrinFvZb68
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D85501399B93D6BBC4C9427181DF5ABCBE3916054205172EC34A8D3D6A63BEDBE06F10
sha3_384: c65eadb5b7772353d344c53bec5bc0d36c83aab70a6cf4af16f91d4b6108060ae074f06ca06a6cc6345aca126cca968d
ep_bytes: 90558bec81c4f0fcffff464abf7d1240
timestamp: 2008-02-08 15:49:16


Version Info:

CompanyName: Qper1 Software
FileDescription: Qper1 Internet Browser
FileVersion: 1190
InternalName: Qper1
LegalCopyright: Copyright © Qper1 Software 1995-2011
OriginalFilename: Qper1.exe
ProductName: Qper1 Internet Browser
ProductVersion: 11.01
Translation: 0x0409 0x04b0

Razy.734002 also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
ClamAVWin.Spyware.Zbot-1279
FireEyeGeneric.mg.589f1cfc0d28a25c
CAT-QuickHealWorm.SlenfBot.Gen
ALYacGen:Variant.Razy.734002
CylanceUnsafe
VIPREVirTool.Win32.Obfuscator.da!j (v)
SangforSuspicious.Win32.Save.a
K7AntiVirusHacktool ( 005286b81 )
AlibabaVirTool:Win32/Obfuscator.5b5e1a6a
K7GWHacktool ( 005286b81 )
Cybereasonmalicious.c0d28a
VirITTrojan.Win32.Packed.BFTR
SymantecTrojan.Gen
ESET-NOD32a variant of Win32/Kryptik.KWA
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyPacked.Win32.Krap.ae
BitDefenderGen:Variant.Razy.734002
NANO-AntivirusTrojan.Win32.Kolab.gzimb
MicroWorld-eScanGen:Variant.Razy.734002
AvastWin32:Downloader-FRA [Trj]
TencentMalware.Win32.Gencirc.10c15a49
Ad-AwareGen:Variant.Razy.734002
EmsisoftGen:Variant.Razy.734002 (B)
ComodoTrojWare.Win32.TrojanSpy.Zbot.G@2tckk5
F-SecureTrojan.TR/Crypt.XPACK.Gen
DrWebTrojan.Packed.21467
ZillyaWorm.Kolab.Win32.5733
TrendMicroWORM_KOLAB.SMB
McAfee-GW-EditionBehavesLike.Win32.Dropper.tm
SophosMal/Generic-S
IkarusBackdoor.Win32.Rbot
GDataGen:Variant.Razy.734002
JiangminTrojan/Generic.dhsf
AviraTR/Crypt.XPACK.Gen
Antiy-AVLTrojan[Packed]/Win32.Krap
ArcabitTrojan.Razy.DB3332
ViRobotWorm.Win32.A.Net-Kolab.5194240
ZoneAlarmPacked.Win32.Krap.ae
MicrosoftTrojan:Win32/Sefnit.R
AhnLab-V3Trojan/Win32.Zbot.R3069
Acronissuspicious
McAfeeGenericRXAA-AA!589F1CFC0D28
MAXmalware (ai score=100)
VBA32Trojan.Zeus.EA.0999
MalwarebytesGeneric.Malware/Suspicious
TrendMicro-HouseCallWORM_KOLAB.SMB
RisingTrojan.Kryptik!8.8 (CLOUD)
YandexTrojan.GenAsa!bYdkHjLBlOE
SentinelOneStatic AI – Malicious PE
FortinetW32/Kryptik.NAS!tr
BitDefenderThetaGen:NN.ZexaF.34212.ur3@aiFlDSoc
AVGWin32:Downloader-FRA [Trj]
PandaBck/Qbot.AO
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Razy.734002?

Razy.734002 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment