⚠️ Overview

Razy is a trojan malware first identified by Microsoft in 2016, classified as a browser modifier and information stealer. It is operated by financially motivated threat actors associated with ad fraud networks, as documented in Microsoft Security Intelligence reports and the Malwarebytes Threat Center.

🔧 Technical Capabilities

Razy primarily propagates through malvertising campaigns and fake download sites, exploiting drive-by download techniques cataloged in MITRE ATT&CK as T1189. Its attack vector includes injecting obfuscated JavaScript into browser processes (Chrome, Firefox, Edge) to redirect search queries, inject ads, and harvest credentials from web forms. The malware establishes command-and-control over HTTP/HTTPS (T1071.001), using domains that mimic legitimate ad services. Persistence is achieved via scheduled tasks (T1053.005) and registry run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include environment checks to avoid sandboxes, code obfuscation via string encoding, and disabling browser security updates (T1562.001). Razy also downloads secondary payloads such as other trojans or ransomware, as noted in a 2019 Trend Micro analysis.

📜 History & Notable Incidents

Razy first appeared in public threat reports in 2016 and escalated in a major campaign during 2019, infecting an estimated 1.5 million devices globally, primarily across North America and Europe (Microsoft Security Intelligence, 2020). No high-profile individual victims have been publicly named, but the malware exploited then-unpatched browser vulnerabilities including CVE-2016-5195 (a privilege escalation flaw) to gain deeper system access. Law enforcement has not taken formal action against its operators, though Microsoft disrupted its infrastructure with sinkholing in late 2020.

🔍 Detection Indicators

Known file hashes from Microsoft’s encyclopedia include Trojan:Win32/Razy variants like SHA256 b3c8a1f2e4d5c6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0. Behavioral indicators include unexpected pop-up ads, browser homepage redirections, and high CPU usage from injected scripts. Network IOCs include domains ending in .rocks or .click used for C2, and User-Agent strings mimicking older browser versions. Registry indicators are keys named RazyUpdate and mutex objects named Razy_Mutex as reported by Malwarebytes.

☠️ Risk & Impact

Razy causes credential theft and financial losses through ad fraud, with the 2019 campaign estimated to generate millions in illicit affiliate revenue (Akamai Security Research). Affected sectors include retail, banking, and advertising, as the malware targets any user visiting compromised ad-supported websites. Exfiltrated data includes login credentials, cookies, and personally identifiable information used for identity theft.

🛡️ Mitigation

Defensive measures include enabling browser automatic updates, using endpoint detection rules that flag the registry keys and scheduled tasks above, and deploying network blocks against known Razy C2 domains (list available via Microsoft’s Threat Intelligence feed). Antivirus products with heuristic JavaScript analysis, such as Microsoft Defender for Endpoint and Malwarebytes, effectively detect and remove Razy variants.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.