Categories: Malware

About “Razy.805012” infection

The Razy.805012 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.805012 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Sniffs keystrokes
Creates known Njrat/Bladabindi RAT registry keys
Binary compilation timestomping detected

How to determine Razy.805012?


File Info:
name: B306BE92FE0863FF7232.mlwpath: /opt/CAPEv2/storage/binaries/811cbe85c604fa50538f1a451a4ce97c13f3c0529fa23f10fcab1f3baa0b4042crc32: 50F38640md5: b306be92fe0863ff723279367cdcf13bsha1: ec8092bf36d93344ed9b8d7994d2620659047e61sha256: 811cbe85c604fa50538f1a451a4ce97c13f3c0529fa23f10fcab1f3baa0b4042sha512: b6e13094d783e5e5e06fd62bd8d40b7435610438e01978de19bf8e0faa921e9f8ae0d5ce85f5575b7da9612dee6080e258ab8063b36596732dd3eefbc94b47b4ssdeep: 768:9CHbQg/4v8E7EFShslsvKKqIjtHVM9hzlkSPSU:aQgAv8E7EMslsSKqWt1M9hZpSUtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D4E29E29438016CCDA7F87323A421BD08568E9518F3DEEDFA8B1110159B3A67C75EBB7sha3_384: f1ab8f3d6722916d4681b769dfa8dbce3565103a19c58b62bcb3c537279307f3a139d7f1e9c42d5831153bf6164bf7b7ep_bytes: ff250020400000000000000000000000timestamp: 2073-05-21 06:55:14
Version Info:
Translation: 0x0000 0x04b0Comments: CompanyName: FileDescription: Fikra402FileVersion: 1.0.0.0InternalName: Fikra402.exeLegalCopyright: Copyright ©  2020LegalTrademarks: OriginalFilename: Fikra402.exeProductName: Fikra402ProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Razy.805012 also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.b306be92fe0863ff
McAfee	Artemis!B306BE92FE08
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win32.65567
Sangfor	Trojan.Win32.Wacatac.B
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Trojan:MSIL/GenKryptik.0dd2864a
K7GW	Trojan ( 005723391 )
K7AntiVirus	Trojan ( 005723391 )
Symantec	Backdoor.Ratenjay
ESET-NOD32	a variant of MSIL/GenKryptik.EVLO
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Razy.805012
NANO-Antivirus	Trojan.Win32.Kryptik.ihfxfr
MicroWorld-eScan	Gen:Variant.Razy.805012
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Generic.Pboo
Ad-Aware	Gen:Variant.Razy.805012
VIPRE	Trojan.Win32.Generic!BT
Emsisoft	Gen:Variant.Razy.805012 (B)
Ikarus	Trojan.MSIL.Krypt
GData	Gen:Variant.Razy.805012
Avira	HEUR/AGEN.1217181
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Generic.ASMalwS.31018FF
Microsoft	Backdoor:Win32/Bladabindi!ml
AhnLab-V3	Trojan/Win32.RL_Generic.C4274340
BitDefenderTheta	Gen:NN.ZemsilF.34212.bm0@a04ksbi
ALYac	Gen:Variant.Razy.805012
Malwarebytes	MachineLearning/Anomalous.94%
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:yAjsKL4E5rEExXOEOJHHcQ)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Injector.MEA!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.2fe086
Panda	Trj/GdSda.A