Razy.969191 information

The Razy.969191 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.969191 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Uses suspicious command line tools or Windows utilities

How to determine Razy.969191?

File Info:
name: 41F86265B21F38E48B48.mlw
path: /opt/CAPEv2/storage/binaries/b4bb0e688c6e66a2dc3c863cb25e50444fe5e67e57057ead0013ed32856fbd08
crc32: 3BA643C5
md5: 41f86265b21f38e48b4870659fd8b4f0
sha1: 751d8289c3a171dcae0e376918a75690f83068b2
sha256: b4bb0e688c6e66a2dc3c863cb25e50444fe5e67e57057ead0013ed32856fbd08
sha512: 590295d5cf507c09806693c1ce000f38b5e4a44ca46455766384d0df46e9bb89e2a80b914a7e5c69f41b934db751bb92ace02b4e2916d605187259091a50a832
ssdeep: 6144:VaszQVOVrSUeVBvVSSZa58VjWjaB/yy43jXj:sszQ4Vu5nv3oUoaB/lm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AF3423F1EF0A7788CDDFDB3361A284EA11E569A8931AF817D091707BEEC5119878847C
sha3_384: 7106668dc9ca8263b5776da965f646fb5407fdebbbdbc00856b3e1848bec2cc7f129a4434432abf9768705d198c045e5
ep_bytes: b80000000083ec04890c2481eb3de6c1
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Razy.969191 also known as:

How to remove Razy.969191?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.