Categories: Malware

Razy.812456 (file analysis)

The Razy.812456 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.812456 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Collects information to fingerprint the system

Related domains:

downloader.aldtop.com

client.aldtop.com

How to determine Razy.812456?


File Info:
crc32: 353EA760md5: b58466e2cbdf5837879e138224f80713name: B58466E2CBDF5837879E138224F80713.mlwsha1: 60f462b9939932883456137b2b37a2bb381e88e1sha256: 01c055adba87bfbb7973e239c8bf8aaf7f15e027d51884e48671faf97c53155csha512: c7268d786b54ca289540848d5eabc5ef05151f54fe0898c2a1f5aa4572f2492045068cdbd9279311092a1816f0fd8ee83ec564582493628f5255a5591aee76a3ssdeep: 24576:Pn7EM0Q9t4hoyU1OqK9l88Zu+xpOLTqO+Qj5Sd:QM1mUjK388ZzpOLKQjwdtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: Copyright (C) 2018InternalName: FastDownloader.exeFileVersion: 3.2.0.8CompanyName: -ProductName: x8f6fx4ef6x4e0bx8f7dx5668ProductVersion: 3.2.0.8FileDescription:  OriginalFilename: FastDownloader.exeTranslation: 0x0804 0x04b0

Razy.812456 also known as:

K7AntiVirus	Riskware ( 0049f6ae1 )
Elastic	malicious (high confidence)
DrWeb	Adware.Downware.19825
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Downer
ALYac	Gen:Variant.Razy.812456
Cylance	Unsafe
Sangfor	PUP.Win32.Downer.mt
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Downloader:Win32/Downer.6518dec8
K7GW	Riskware ( 0049f6ae1 )
Cybereason	malicious.2cbdf5
Cyren	W32/Trojan.XUHI-3162
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:WormX-gen [Wrm]
Kaspersky	not-a-virus:Downloader.Win32.Agent.mquf
BitDefender	Gen:Variant.Razy.812456
NANO-Antivirus	Trojan.Win32.Razy.iuoihf
MicroWorld-eScan	Gen:Variant.Razy.812456
Ad-Aware	Gen:Variant.Razy.812456
Sophos	Downer (PUA)
FireEye	Gen:Variant.Razy.812456
Emsisoft	Gen:Variant.Razy.812456 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Downloader.Agent.oro
Webroot	W32.Adware.Gen
eGambit	Unsafe.AI_Score_87%
Microsoft	PUA:Win32/Downer
Gridinsoft	Adware.Agent.sd!c
Arcabit	Trojan.Razy.DC65A8
GData	Gen:Variant.Razy.812456
AhnLab-V3	PUP/Win32.RL_Downloader.R367892
McAfee	Artemis!B58466E2CBDF
MAX	malware (ai score=86)
VBA32	Downloader.Agent
Malwarebytes	PUP.Optional.ChinAd
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002H0CDR21
Rising	Adware.Downloader!1.CB5D (CLOUD)
Ikarus	PUA.RiskWare.Downer
Fortinet	Riskware/Downer.DD89
AVG	Win32:WormX-gen [Wrm]