Malware

Razy.961710 removal

Malware Removal

The Razy.961710 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Razy.961710 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Performs HTTP requests potentially not found in PCAP.
  • CAPE extracted potentially suspicious content
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Attempts to modify proxy settings
  • Harvests cookies for information gathering

How to determine Razy.961710?


File Info:

name: 59010983277B284F5E52.mlw
path: /opt/CAPEv2/storage/binaries/1c5f0c0d224c567e526f9cc70221870f1953f0462e132ef460ad7d94ed9c88dc
crc32: 84A5F875
md5: 59010983277b284f5e526a5fc22c90b7
sha1: 0b93e13a97b07f392fedf81d969d428a0e0cb775
sha256: 1c5f0c0d224c567e526f9cc70221870f1953f0462e132ef460ad7d94ed9c88dc
sha512: 3c7bd260f4665d8b5170e6b616c63a110defc8fee8a5332be18f9c551ee3a9ada1c121754e8e0c83283b49719cbdfe75a87a5ff57dc374fe63814a1d651c6305
ssdeep: 768:ys4fknWkYdIuzvVYwqrZkcSSiXNyDpSdgranJyfofHVneXgmXlSo:ys4fknSoZkc3isVSQaJyfmHCJso
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12D538D42F7A09B22C0AF673794E70345A33FAC959752470B1188B12538722BA7B779E6
sha3_384: 02702c087ea1d72da4c97648da77951858b0a3f362fa0d83093f451e6f3893526baaf2d1ad75e06d764e8f85701abe4f
ep_bytes: b80c3d42005064ff3500000000648925
timestamp: 2011-01-03 05:10:27

Version Info:

Translation: 0x0804 0x04b0
CompanyName: zcyzzzm
ProductName: tvtongji
FileVersion: 3.00
ProductVersion: 3.00
InternalName: tvtongji
OriginalFilename: tvtongji.EXE

Razy.961710 also known as:

BkavW32.AIDetect.malware2
LionicHeuristic.File.Generic.00×1!p
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Razy.961710
FireEyeGen:Variant.Razy.961710
ALYacGen:Variant.Razy.961710
CylanceUnsafe
VIPREGen:Variant.Razy.961710
K7AntiVirusTrojan ( 003b01701 )
K7GWTrojan ( 003b01701 )
Cybereasonmalicious.a97b07
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyUDS:DangerousObject.Multi.Generic
BitDefenderGen:Variant.Razy.961710
NANO-AntivirusTrojan.Win32.TrjGen.oectr
Ad-AwareGen:Variant.Razy.961710
ComodoTrojWare.Win32.Agent.cardf@1qek1k
ZillyaTrojan.Genome.Win32.125285
McAfee-GW-EditionGenericRXCE-RN!8CCC17013947
Trapminemalicious.high.ml.score
EmsisoftGen:Variant.Razy.961710 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Razy.961710
AviraHEUR/AGEN.1230951
MAXmalware (ai score=86)
MicrosoftTrojan:Win32/Wacatac.B!ml
GoogleDetected
McAfeeArtemis!59010983277B
TACHYONTrojan/W32.Genome.61440.BF
MalwarebytesMalware.Heuristic.1001
RisingTrojan.Win32.FakeMS.ze (CLOUD)
IkarusTrojan.Win32.Scar
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Tfr.D!tr
BitDefenderThetaGen:NN.ZevbaCO.34682.di0fayCPtwpb
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_70% (W)

How to remove Razy.961710?

Razy.961710 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment