What is “Ser.Razy.3849”?

The Ser.Razy.3849 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ser.Razy.3849 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Sorbian
• The binary likely contains encrypted or compressed data.
• .NET file is packed/obfuscated with SmartAssembly
• Authenticode signature is invalid
• Anomalous .NET characteristics

How to determine Ser.Razy.3849?

File Info:
name: 20E08B32A3CC109B0BA8.mlw
path: /opt/CAPEv2/storage/binaries/9f90f29e7641858cb3ba2071aabfdab16204f8b7da6b72ff9282b35132b60653
crc32: 1BCE72BD
md5: 20e08b32a3cc109b0ba844fca936d264
sha1: b3fe843b0d059f5e268cb381c87dc4f3f04c78bc
sha256: 9f90f29e7641858cb3ba2071aabfdab16204f8b7da6b72ff9282b35132b60653
sha512: ecc289ed4b87fa95e7c62e001fb8a6974ad25390a17660d0075fd30022e2b0c1f22c2d12a8d41058eca4dea5a0c8096662744a5613b9be37d0bf518492a819f1
ssdeep: 6144:UYTb01mA1eFIl5PhU0lLLey6OVqy58A971JCRc:UYaxee5ZU0PzV5710C
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10BA5F6C3B444248DF8DE827BB9DA8E26E1D11D9B0D43190152B13F50BFEEAD297C45AE
sha3_384: f554ca62a7878cb47c95ec03850ffe7420862ddb7ab498fcfaeace9d440593f0554c1a44675f21c6f299be5b9ff5a0e5
ep_bytes: ff250020400000000000000000000000
timestamp: 2019-05-24 05:07:13

Version Info:
0: [No Data]

Ser.Razy.3849 also known as:

How to remove Ser.Razy.3849?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.