Razy.855825 malicious file

The Razy.855825 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.855825 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
A process created a hidden window
Performs some HTTP requests
Executed a very long command line or script command which may be indicative of chained commands or obfuscation
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Collects information about installed applications
Attempts to modify proxy settings
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

api.sendspace.com

ocsp.digicert.com

How to determine Razy.855825?


File Info:
crc32: 8AFC223C
md5: 595b52c3c8c131c531649b3614e3299c
name: 595B52C3C8C131C531649B3614E3299C.mlw
sha1: f1531e4c275efa444ba4f9f28de119f4126748db
sha256: 31900317211e7a806d0ecf1de8d47bee1f31a590535a10e4405542f33e2ae16f
sha512: 6a3bd32b1b16fd707ed227398867ea61861bd86c648fad5ef497fca3c24683b64cd42b3301fa3f43e559d3e06ade71639c4d5f526a26bd346a1da2bacd228f2f
ssdeep: 3072:rSM2UvNtVaapGWIGvA4mzy6MqqDL2/Gakox7/LTM4GSjrNa:uM2UFaiVptIypqqDL6Gah/LZGS/N
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Microsoftxae Windowsxae Operating System
FileVersion: 10.0.18362.1 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.18362.1
FileDescription: Microsoft Network Realtime Inspection Service
OriginalFilename: wpfw.exe
Translation: 0xffff 0x04b0

Razy.855825 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Razy.855825
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Cybereason	malicious.3c8c13
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	UDS:Trojan.Multi.GenericML.xnet
BitDefender	Gen:Variant.Razy.855825
MicroWorld-eScan	Gen:Variant.Razy.855825
Ad-Aware	Gen:Variant.Razy.855825
Sophos	ML/PE-A + Mal/EncPk-ZC
BitDefenderTheta	Gen:NN.ZexaF.34684.hu0@aypjQLci
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_HPCERBER.SM7
McAfee-GW-Edition	BehavesLike.Win32.Emotet.ch
FireEye	Generic.mg.595b52c3c8c131c5
Emsisoft	Gen:Variant.Razy.855825 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/AD.Hvnc.pubrg
eGambit	Unsafe.AI_Score_91%
Microsoft	Ransom:Win32/Cerber.L!bit
Arcabit	Trojan.Razy.DD0F11
GData	Gen:Variant.Razy.855825
AhnLab-V3	Ransomware/Win.Hpcerber.C4437973
McAfee	Artemis!595B52C3C8C1
MAX	malware (ai score=80)
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom_HPCERBER.SM7
Fortinet	W32/Ransom_HPCERBER.SM7
AVG	Win32:Malware-gen

How to remove Razy.855825?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Razy.855825 malicious file