Razy.798352 (file analysis)

The Razy.798352 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.798352 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous .NET characteristics

How to determine Razy.798352?

File Info:
name: 91E7206F8ADF2C07929F.mlw
path: /opt/CAPEv2/storage/binaries/5281a955f23cb8df059feb7680688f6f4bfd9d5ba0068af9232b4cdb7b10eb8a
crc32: 60945F8C
md5: 91e7206f8adf2c07929fef875d295b30
sha1: b57b0ec7eda32b1d36af60dfbacb7dee3c635986
sha256: 5281a955f23cb8df059feb7680688f6f4bfd9d5ba0068af9232b4cdb7b10eb8a
sha512: 101fe4e81354ca5f197a1e15af6bbc3d73d7e2b19bedf8e93e3c23b2178c4d6c1056b3ee00041f413fd29d048c04ea4c4b4be3913657cc5676f057325f36898c
ssdeep: 3072:Fap2i/CA+S7O20wlJdVoTQee4BOxdUk0DLXgENcVJK7r0QXq0b:FapFASKYdxehIwDMEsK7jXq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BAE3194676884702D9A868BAC1EF293403E2BECB3673D6953F48378D1D523B39D85B4D
sha3_384: b0d6e1fbdc429cc7d537e65b1bf35da82dcb9e6f07d4e3861b9a6dfbef2884574d3ccc8cdca66fe94e39aa7d71a2a71d
ep_bytes: ff250020400000000000000000000000
timestamp: 2020-11-19 00:29:57

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: stockstub.exe
LegalCopyright:  
OriginalFilename: stockstub.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Razy.798352 also known as:

How to remove Razy.798352?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.