Razy.749196 (file analysis)

The Razy.749196 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.749196 virus can do?

Executable code extraction
Creates RWX memory
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Razy.749196?


File Info:
crc32: B8A17B98
md5: f3ba2da5356180593f1996dfc5154b64
name: F3BA2DA5356180593F1996DFC5154B64.mlw
sha1: a183b59b1187cf88a52d391943bb8e1a8ac85368
sha256: 47e7b69c40e6620db375da0df218a5162ace0c3acee7ee129bfd77f24140dd52
sha512: 27f309498c0974960dd2dbd2f7bd4d969d08d4be5186f1a30b18fa837fdacb0a79cdabfb1a19b7456d20b389afa8d6b01abd4935f74823903951d4edb8df97be
ssdeep: 384:AQ8p6HzWeJ1jibm49nXFC/XoHENCShMmEai0ioh+NGq:98p6HzWe1jibm49naXhImpi0i2+t
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2017
Assembly Version: 1.0.0.0
InternalName: wincheck.exe
FileVersion: 1.0.0.0
CompanyName: Flash Update
LegalTrademarks: Flash Update
Comments: Flash Update
ProductName: Flash Update
ProductVersion: 1.0.0.0
FileDescription: Flash Update
OriginalFilename: wincheck.exe

Razy.749196 also known as:

K7AntiVirus	Trojan ( 0050bc7a1 )
ALYac	Gen:Variant.Razy.749196
Cylance	Unsafe
Zillya	Trojan.ClipBanker.Win32.447
Sangfor	Trojan.Win32.ClipBanker.8
K7GW	Trojan ( 0050bc7a1 )
Cybereason	malicious.535618
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/ClipBanker.BB
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Razy.749196
NANO-Antivirus	Trojan.Win32.Banker.epsski
MicroWorld-eScan	Gen:Variant.Razy.749196
Tencent	Win32.Trojan.Spy.Ednm
Ad-Aware	Gen:Variant.Razy.749196
Sophos	Mal/Generic-S
Comodo	Malware@#2topsr2nlk5bk
BitDefenderTheta	Gen:NN.ZemsilF.34722.xm0@aCoJzzp
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	GenericRXCF-SC!F3BA2DA53561
FireEye	Generic.mg.f3ba2da535618059
Emsisoft	Gen:Variant.Razy.749196 (B)
SentinelOne	Static AI – Malicious PE
Antiy-AVL	Trojan/Generic.ASMalwS.2094F02
Microsoft	Trojan:Win32/Skeeyah.A!rfn
AegisLab	Trojan.Win32.Generic.4!c
GData	Gen:Variant.Razy.749196
McAfee	GenericRXCF-SC!F3BA2DA53561
MAX	malware (ai score=84)
Panda	Trj/GdSda.A
Yandex	Trojan.ClipBanker!ReLuof0UCcs
Ikarus	Trojan.MSIL.ClipBanker
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Generic.DN.8807AE!tr
AVG	Win32:Malware-gen

How to remove Razy.749196?

Razy.749196 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X