Razy.976070 removal tips

The Razy.976070 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.976070 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Razy.976070?


File Info:
name: 9BD18E82222E876F1783.mlw
path: /opt/CAPEv2/storage/binaries/97a2e8056e640f80b11cfca23158917a79d6a5c072c9fc70e0323f0dfdb112f6
crc32: 0C1F1B9F
md5: 9bd18e82222e876f17838b5305e68f84
sha1: 8ed4c65a1a1176bc15c6acc6ed2231e8a927008d
sha256: 97a2e8056e640f80b11cfca23158917a79d6a5c072c9fc70e0323f0dfdb112f6
sha512: 549d206fb8dc3fdf81d59ea89e79c364b06cb9de6ad06d499b1c8685264405134ca2ce241dafc6333dabc02107f52685b078d0def8e35714d6d4902e1bdf8697
ssdeep: 12288:yFMXOAPNxPNdkVHD2OK3wbFPsnVyMO80F9/hEZgyQ:yFMXOAPNzWVHC/3GqVyMOl/hEZgy
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1FE9423ACFDC2E1CDC56ACAB1FE9150480F7A49B10E1AA10D20326D5E5ED7B18AD35CDE
sha3_384: 006b71d93006649d41a6451fa5bb57de6b50cdb2d69380e281140694e1623d9a100e9b82e50809d1313f61be4443beb8
ep_bytes: ff250020400000000000000000000000
timestamp: 2090-04-16 04:04:53

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: AppXSVC_poc
FileVersion: 1.0.0.0
InternalName: AppXSVC_poc.exe
LegalCopyright: Copyright ©  2019
LegalTrademarks: 
OriginalFilename: AppXSVC_poc.exe
ProductName: AppXSVC_poc
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Razy.976070 also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (moderate confidence)
DrWeb	Exploit.CVE-2019-1064.3
MicroWorld-eScan	Gen:Variant.Razy.976070
FireEye	Gen:Variant.Razy.976070
ALYac	Gen:Variant.Razy.976070
BitDefenderTheta	Gen:NN.ZemsilCO.34806.Am0@aCdX2vi
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Exploit.CVE-2019-1064.B
Kaspersky	HEUR:Exploit.Win32.CVE-2019-1064.a
BitDefender	Gen:Variant.Razy.976070
Avast	ExploitX-gen [Expl]
Ad-Aware	Gen:Variant.Razy.976070
Emsisoft	Gen:Variant.Razy.976070 (B)
VIPRE	Gen:Variant.Razy.976070
McAfee-GW-Edition	GenericRXQA-JN!9BD18E82222E
SentinelOne	Static AI – Malicious PE
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Razy.976070
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.C3636144
McAfee	GenericRXQA-JN!9BD18E82222E
APEX	Malicious
Rising	Trojan.Generic/MSIL@AI.98 (RDM.MSIL:jio0zeIj9uapWgU2xSjrHQ)
MAX	malware (ai score=82)
MaxSecure	Trojan.Malware.300983.susgen
AVG	ExploitX-gen [Expl]
Cybereason	malicious.a1a117
Panda	Trj/GdSda.A

How to remove Razy.976070?

Razy.976070 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X