Trojan:Win32/Razy.V!MTB removal

The Trojan:Win32/Razy.V!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Razy.V!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (1 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Starts servers listening on 0.0.0.0:40000
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Arabic (Oman)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location

How to determine Trojan:Win32/Razy.V!MTB?

File Info:
name: 615B95E67F1AF0C42C72.mlw
path: /opt/CAPEv2/storage/binaries/dfa9d8cd442b0d7f340da2aaee6633e1dd96ef29e4160830df97077b9f066be8
crc32: 61D31A7E
md5: 615b95e67f1af0c42c722fecce53f096
sha1: b61a6f556b0355a0e457da1ee724f8a134fb0b93
sha256: dfa9d8cd442b0d7f340da2aaee6633e1dd96ef29e4160830df97077b9f066be8
sha512: f1c15b951e845c442d8e724d81de7b0b466437116dd3b6950a0f208b1d3e8964df972eabc078133d4a438d572f3eef5e30606172552cb7971c0ce42ad17d742c
ssdeep: 49152:bn1Y8aG2lsDpbcy2jHyilPxqUcY4Fw+f53:bnQGysSBmV
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T10485124014C7CB78C689223AAA488BEC97DA75C2407C6599F3DE4F2E49F17714E278F6
sha3_384: 99c7ea628dfede6eeed0c41a03526586e4d62f422c6044f5f7d3c6d49ad1a04fdcaf541d8fc855788c4f3a7788313764
ep_bytes: e80d040000e974feffff558bec6a00ff
timestamp: 2018-12-16 01:59:14

Version Info:
FileDescription: СОМ Surrogatе
FileVersion: 1.0.0.0
ProductName: СОМ Surrogatе
ProductVersion: 1.0.0.0
Translation: 0x0800 0x04b0

Trojan:Win32/Razy.V!MTB also known as:

How to remove Trojan:Win32/Razy.V!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.