Razy.810157 removal instruction

The Razy.810157 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.810157 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• .NET file is packed/obfuscated with SmartAssembly
• Authenticode signature is invalid
• Sniffs keystrokes
• Created a process from a suspicious location
• Creates known Njrat/Bladabindi RAT registry keys

How to determine Razy.810157?

File Info:
name: 4D3A04BB364F40D4BBD1.mlw
path: /opt/CAPEv2/storage/binaries/292bb8e2a0e3ffe3b63d0d726e2010bf13aba6e3acfaefd2d6ad56d688800efa
crc32: 4A232F41
md5: 4d3a04bb364f40d4bbd114e2de573af0
sha1: b85f6607db0532ebcdbbcdb130b45c63a0036bf5
sha256: 292bb8e2a0e3ffe3b63d0d726e2010bf13aba6e3acfaefd2d6ad56d688800efa
sha512: c57b0deec704f48af89abf9a38f94b1b265d32c44079ebcb9ef987b12313bce4d7f0701b95fe7ea195a8dbd25463e5da736dda82794f5ea99c24e454d14db7e1
ssdeep: 1536:SlYvVp4295K65qsj3PUlqJSamHF5WkjZm0oMhJaaxBRUo5nXyXCw2n+K84MliLMI:ZVpXL9HslqCHvDJdJaERU2X4u+b4f
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E9B3E14DEB8C8B93E7598EFEE1A233E483E090735747FB871CCA14D518A23A1A5195C7
sha3_384: 51505687b30570f885218673faf1883812286b148d81af5b37a194d771c36128192e34d699f8869f7a68ba779b44b16d
ep_bytes: ff250020400000000000000000000000
timestamp: 2020-11-25 19:00:54

Version Info:
Translation: 0x0000 0x04b0
Comments: yak)§?59%TI
CompanyName: uai729VZ3MD
FileDescription: uai729VZ3MD
FileVersion: 4.1.5.​0
InternalName: btx2.exe
LegalCopyright: uai729VZ3MD
LegalTrademarks: yak)§?59%TI
OriginalFilename: btx2.exe
ProductName: yak)§?59%TI
ProductVersion: 4.1.5.​0
Assembly Version: 4.2.4.5

Razy.810157 also known as:

How to remove Razy.810157?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.