Ransom.Loki.2535 information

The Ransom.Loki.2535 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Loki.2535 virus can do?

CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with SmartAssembly
Authenticode signature is invalid
Binary file triggered YARA rule

How to determine Ransom.Loki.2535?


File Info:
name: EFB8CB73940D8C8F2219.mlw
path: /opt/CAPEv2/storage/binaries/0c51ad3f9767fbe70b6b26565a1f50442672009db1eef53bb6c713b0c3307dfe
crc32: 249D9CCF
md5: efb8cb73940d8c8f221916acff228079
sha1: 9c69cfd179a49be845ad63e8862d6cd31ff1210a
sha256: 0c51ad3f9767fbe70b6b26565a1f50442672009db1eef53bb6c713b0c3307dfe
sha512: b089f14795a7e878d5f88681b5c056a6f3f386613ca23bc76a5e4c60c736b666cba6a1c68175260d4400008539dddec69996495aeeaea5c3d309edda40d1eda7
ssdeep: 768:7Tfp/PSqoGWQOj1175KNWKfACuAomj0s36wH+2G:nfp/poL/KsKfbr0EDH+Z
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FA73E8C3A94013B0FDBD8B72E03B9D9607673D3EEEB4BA1D3888F16516B31D24126995
sha3_384: d39f5ea2bcea632ae03bdbafe37e37ad73cbf96dedd8b97b94dd894afb0f1f7e17c7f63c5ca00af7b7f84d0ff649bc34
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-10-21 11:31:01

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: Jeuaezl.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: Jeuaezl.exe
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ransom.Loki.2535 also known as:

Bkav	W32.AIDetectMalware.CS
MicroWorld-eScan	Gen:Variant.Ransom.Loki.2535
FireEye	Generic.mg.efb8cb73940d8c8f
Skyhigh	BehavesLike.Win32.Generic.lz
McAfee	RDN/Generic Downloader.x
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Downloader.Msil.Lazy.Vrum
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Trojan:MSIL/Scarsi.c60139db
K7GW	Trojan-Downloader ( 00599cb31 )
K7AntiVirus	Trojan-Downloader ( 00599cb31 )
Symantec	MSIL.Downloader!gen7
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.NVA
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Scarsi.gen
BitDefender	Gen:Variant.Ransom.Loki.2535
Avast	Win32:DropperX-gen [Drp]
Tencent	Malware.Win32.Gencirc.13b7346f
Emsisoft	Gen:Variant.Ransom.Loki.2535 (B)
F-Secure	Heuristic.HEUR/AGEN.1323344
DrWeb	Trojan.DownLoaderNET.488
VIPRE	Gen:Variant.Ransom.Loki.2535
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=88)
Google	Detected
Avira	HEUR/AGEN.1323344
Antiy-AVL	Trojan/MSIL.Scarsi
Kingsoft	malware.kb.c.1000
Microsoft	Trojan:MSIL/AgentTesla.CAF!MTB
Arcabit	Trojan.Ransom.Loki.D9E7
ZoneAlarm	HEUR:Trojan.MSIL.Scarsi.gen
GData	Gen:Variant.Ransom.Loki.2535
AhnLab-V3	Trojan/Win.DG.C5284889
ALYac	Gen:Variant.Ransom.Loki.2535
Cylance	unsafe
Panda	Trj/Chgt.AA
Rising	Malware.Obfus/MSIL@AI.96 (RDM.MSIL2:ckNSU4vw+qYv1DLPOsR8FA)
Ikarus	Trojan-Downloader.MSIL.Agent
Fortinet	MSIL/Agent.NVA!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.36802.em0@amrv4Lb
AVG	Win32:DropperX-gen [Drp]
DeepInstinct	MALICIOUS

How to remove Ransom.Loki.2535?

Ransom.Loki.2535 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X