How to remove “Trojan:Win32/Razy.XA!MTB”?

The Trojan:Win32/Razy.XA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Razy.XA!MTB virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan:Win32/Razy.XA!MTB?


File Info:
name: A4BF1A01FD1EDC017CF4.mlw
path: /opt/CAPEv2/storage/binaries/aa97ce7f6d04e90c3b9d168a6035e00ea2586b01b458eed45b4dee253a1c2941
crc32: 4AC516E9
md5: a4bf1a01fd1edc017cf4f58c17c89f39
sha1: 2ac9ace383f10f5abdbc4655eb3c5523ab192274
sha256: aa97ce7f6d04e90c3b9d168a6035e00ea2586b01b458eed45b4dee253a1c2941
sha512: c6754276dc633af140a9d88f73f5b09645a008a6807a1bb275f6cd151db6e0fee4ba01730a3d13a07a244daf03a992c217cbe61c36067554126938787aeb7206
ssdeep: 3072:oz1fPxQL5rYFAOowL5rWfAXONbANvQwEy91/V+tXnAaPdMgLvSZzYzUf9N:wfJQ9YSOzhetNbo1eAaPdMBzZ
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T12FF3D0A2264B59D0F0EAEEBB43E0C6C653657A935A42532FFE8233A571F399007354F1
sha3_384: 8157ff396b3aa877e6eaa53084b250818f4433f1c12ce97fa6d3239cbeab44fc7286ca90d907f952f78bbae4b6a1e7b4
ep_bytes: b8000000005129f65a01fe21f6465268
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan:Win32/Razy.XA!MTB also known as:

Bkav	W32.AIDetect.malware1
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Razy.866116
FireEye	Generic.mg.a4bf1a01fd1edc01
ALYac	Gen:Variant.Razy.866116
Cylance	Unsafe
VIPRE	Gen:Variant.Razy.866116
K7AntiVirus	Trojan ( 0058e60a1 )
K7GW	Trojan ( 0058e60a1 )
Cybereason	malicious.1fd1ed
Cyren	W32/Kryptik.ECM.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.XVS
APEX	Malicious
ClamAV	Win.Packed.Razy-9867637-0
Kaspersky	HEUR:Trojan.Win32.Copak.vho
BitDefender	Gen:Variant.Razy.866116
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:Trojan-gen
Tencent	Trojan.Win32.Copak.zb
Ad-Aware	Gen:Variant.Razy.866116
Emsisoft	Gen:Variant.Razy.866116 (B)
DrWeb	Trojan.Siggen14.40460
Zillya	Trojan.Injector.Win32.1000139
McAfee-GW-Edition	BehavesLike.Win32.Glupteba.cc
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A + Troj/Agent-BGOS
Ikarus	Trojan.Win32.Crypt
GData	Gen:Variant.Razy.866116
Jiangmin	Trojan.Copak.lic
Avira	TR/Crypt.XPACK.Gen
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Generic.ASMalwS.5123
Arcabit	Trojan.Razy.DD3744
Microsoft	Trojan:Win32/Razy.XA!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R293305
Acronis	suspicious
McAfee	Glupteba-FTSD!A4BF1A01FD1E
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Malware.AI.4176750019
Rising	Trojan.Injector!1.CD26 (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.ECM!tr
BitDefenderTheta	Gen:NN.ZexaF.34786.kuZ@aGo3wXi
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/Razy.XA!MTB?

Trojan:Win32/Razy.XA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X