Trojan:Win32/Razy.CP!MTB malicious file

The Trojan:Win32/Razy.CP!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Razy.CP!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Deletes its original binary from disk
• Created a process from a suspicious location
• Creates a copy of itself
• Deletes executed files from disk

How to determine Trojan:Win32/Razy.CP!MTB?

File Info:
name: D388199C2A97505124BC.mlw
path: /opt/CAPEv2/storage/binaries/f6efd8b1e0e46a7fe6df9a90f431c16b71821e9ed599aa69f67e9e6f44b36354
crc32: 8E7CF2CD
md5: d388199c2a97505124bc1cf09b17686b
sha1: 445a93940cf5dad418dcad1884007b8505cb204f
sha256: f6efd8b1e0e46a7fe6df9a90f431c16b71821e9ed599aa69f67e9e6f44b36354
sha512: 82cad5b2b2983ff4afae80e28259a34124b72623e8752669dc08a5d17aa5b03b415fced9fe26b0c148c477b1cb2cc96f2e84efae8fc245cf7595be36d382b9b0
ssdeep: 1536:2x9LaAcftnJ/lXNKu4q9pvS1IuNVlAlDVuGVqs/KLCABHxJdxBn:2x9eAGJ/Gu4q9pvdFlE47SCABHHN
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T14783F25B6687D043D8D01E7987A450E96EB825AFF2CAF7F79A8104A127BC82645C123B
sha3_384: 30072ac5b8e806ab862aad4c58615413fccb9d4903345229b7d351ea376404355e3f7662bfe8e9f230a83733c44e35a8
ep_bytes: be0000000083ec04890c244f81efeba4
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan:Win32/Razy.CP!MTB also known as:

How to remove Trojan:Win32/Razy.CP!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.