About “Razy.766176” infection

The Razy.766176 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.766176 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Tries to unhook or modify Windows functions monitored by Cuckoo
• CAPE detected the RedLine malware family
• Anomalous binary characteristics

How to determine Razy.766176?

File Info:
name: 0E0056B71E13AB00320F.mlw
path: /opt/CAPEv2/storage/binaries/f1001fa7d2b6c1bca510b00eeb48dc3d5cb6f53aaebb2730fc5966e0446c4a36
crc32: 24EF2FEC
md5: 0e0056b71e13ab00320f1f56911b3641
sha1: 11f6d2df410232dbfa93ea220740909647d950fb
sha256: f1001fa7d2b6c1bca510b00eeb48dc3d5cb6f53aaebb2730fc5966e0446c4a36
sha512: 1c09d6d4f3d2308f80da4367cedce579d3d7859efb3aaba966ae9bd8f4cb499311cd24d3c204c814f9d5b9b4c4463a282f7ad7c331c903ff747d5ee20ad8bc85
ssdeep: 12288:n+oiuT0+RfoSVbG0k3YTn9kBerfcFju2TPw:nb99f+ezcQ2TPw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C7945A333A9944E6F57D07F42391DA331DDEAC7B0DD4890A27D831BA85B93A1849C62F
sha3_384: e241f4a17a566b601b3a49f557339e170e5b232918ebc2465bb1dee7791be8a941aa085b2c6e8ef7dee6f621bbf3c210
ep_bytes: e8a3020000e97afeffff558bec8b4508
timestamp: 2016-05-01 23:25:36

Version Info:
CompanyName: Node.js
ProductName: Node.js
FileDescription: Node.js: Server-side JavaScript
FileVersion: 12.16.3
ProductVersion: 12.16.3
OriginalFilename: node.exe
InternalName: node
LegalCopyright: Copyright Node.js contributors. MIT license.
Translation: 0x0409 0x04b0

Razy.766176 also known as:

How to remove Razy.766176?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.