Categories: Malware

Razy.734002 information

The Razy.734002 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.734002 virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Enumerates running processes
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Russian
Authenticode signature is invalid
Created a process from a suspicious location

How to determine Razy.734002?


File Info:
name: 589F1CFC0D28A25C8C98.mlwpath: /opt/CAPEv2/storage/binaries/b9a00ed3d3e3ab041d63a5e0404c9b5b848168f459952bbb0a1adb9224a124a0crc32: 76693A4Bmd5: 589f1cfc0d28a25c8c98c098c5dcae08sha1: 9af7a46844677155ab2ffa5d2ba87bcdec777f75sha256: b9a00ed3d3e3ab041d63a5e0404c9b5b848168f459952bbb0a1adb9224a124a0sha512: 2aa7987fa4e386bc3e6c4deacf26df23e92e898d5e80ad7d6dc73a153fd126a121444a5b0f7f4ff42fa11a5ddcdb5fec8d967c358393b50d420245a4794b0617ssdeep: 24576:TEBLQ6QkH7/P9DriII9FoGo7AZhBMaBVziB8:TEpTFDrinFvZb68type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D85501399B93D6BBC4C9427181DF5ABCBE3916054205172EC34A8D3D6A63BEDBE06F10sha3_384: c65eadb5b7772353d344c53bec5bc0d36c83aab70a6cf4af16f91d4b6108060ae074f06ca06a6cc6345aca126cca968dep_bytes: 90558bec81c4f0fcffff464abf7d1240timestamp: 2008-02-08 15:49:16
Version Info:
CompanyName: Qper1 SoftwareFileDescription: Qper1 Internet BrowserFileVersion: 1190InternalName: Qper1LegalCopyright: Copyright © Qper1 Software 1995-2011OriginalFilename: Qper1.exeProductName: Qper1 Internet BrowserProductVersion: 11.01Translation: 0x0409 0x04b0

Razy.734002 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
ClamAV	Win.Spyware.Zbot-1279
FireEye	Generic.mg.589f1cfc0d28a25c
CAT-QuickHeal	Worm.SlenfBot.Gen
ALYac	Gen:Variant.Razy.734002
Cylance	Unsafe
VIPRE	VirTool.Win32.Obfuscator.da!j (v)
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Hacktool ( 005286b81 )
Alibaba	VirTool:Win32/Obfuscator.5b5e1a6a
K7GW	Hacktool ( 005286b81 )
Cybereason	malicious.c0d28a
VirIT	Trojan.Win32.Packed.BFTR
Symantec	Trojan.Gen
ESET-NOD32	a variant of Win32/Kryptik.KWA
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Packed.Win32.Krap.ae
BitDefender	Gen:Variant.Razy.734002
NANO-Antivirus	Trojan.Win32.Kolab.gzimb
MicroWorld-eScan	Gen:Variant.Razy.734002
Avast	Win32:Downloader-FRA [Trj]
Tencent	Malware.Win32.Gencirc.10c15a49
Ad-Aware	Gen:Variant.Razy.734002
Emsisoft	Gen:Variant.Razy.734002 (B)
Comodo	TrojWare.Win32.TrojanSpy.Zbot.G@2tckk5
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	Trojan.Packed.21467
Zillya	Worm.Kolab.Win32.5733
TrendMicro	WORM_KOLAB.SMB
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tm
Sophos	Mal/Generic-S
Ikarus	Backdoor.Win32.Rbot
GData	Gen:Variant.Razy.734002
Jiangmin	Trojan/Generic.dhsf
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan[Packed]/Win32.Krap
Arcabit	Trojan.Razy.DB3332
ViRobot	Worm.Win32.A.Net-Kolab.5194240
ZoneAlarm	Packed.Win32.Krap.ae
Microsoft	Trojan:Win32/Sefnit.R
AhnLab-V3	Trojan/Win32.Zbot.R3069
Acronis	suspicious
McAfee	GenericRXAA-AA!589F1CFC0D28
MAX	malware (ai score=100)
VBA32	Trojan.Zeus.EA.0999
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	WORM_KOLAB.SMB
Rising	Trojan.Kryptik!8.8 (CLOUD)
Yandex	Trojan.GenAsa!bYdkHjLBlOE
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Kryptik.NAS!tr
BitDefenderTheta	Gen:NN.ZexaF.34212.ur3@aiFlDSoc
AVG	Win32:Downloader-FRA [Trj]
Panda	Bck/Qbot.AO
CrowdStrike	win/malicious_confidence_100% (D)