Categories: Ransom

Ransom.Loki.412 (file analysis)

The Ransom.Loki.412 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Loki.412 virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Checks the presence of disk drives in the registry, possibly for anti-virtualization
Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom.Loki.412?


File Info:
name: 61DB820B22C0AA0308CF.mlwpath: /opt/CAPEv2/storage/binaries/c79baaeb794739b03255adc9656d941f94eac63646bd6885d243a147da9970edcrc32: C8DA2799md5: 61db820b22c0aa0308cf0b9c542ff92dsha1: 443480edcb5fa6f9627f019b2b201f61aca29f75sha256: c79baaeb794739b03255adc9656d941f94eac63646bd6885d243a147da9970edsha512: 2a7ef825992e3ba6298fabf98ef93cae797c1cef25be9931a3baabde7e9b5abdfcfa7c3e605a9712739532ecb4b249eb10faf4ca74f07b36da2a63cb0bdf0a18ssdeep: 1536:SzcJ6L6zb4MiVOfiGnTNkoPPr1nAnjceWk7mprm/Q76DLi8Gq5DybKSEHhK+sQVS:SAoL6mUfZN5q4Vkyprt0W+5DFHNRUtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10A14ADE27690C072C58B55345870CBB56BBAB8221BB5894F37A8177E5F303E2567A30Fsha3_384: 5c80c596d7242660b9cfc111f9fc20a8d91fd454948e315f0e52370f1da6675c28151ef9d6d945184b5a85eb7d6ff1bdep_bytes: e82d320000e979feffff8bff558bec83timestamp: 2021-02-06 15:54:06
Version Info:
FileVersion: 21.79.127.9InternationalName: povgwaoci.iweCopyrighz: Copyrighz (C) 2022, fuzkorteTranslations: 0x0116 0x00d3

Ransom.Loki.412 also known as:

Bkav	W32.AIDetectMalware
AVG	Win32:AceCrypter-K [Cryp]
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Ransom.Loki.412
FireEye	Generic.mg.61db820b22c0aa03
CAT-QuickHeal	Ransom.Stop.P5
Skyhigh	BehavesLike.Win32.Lockbit.dm
McAfee	Packed-GDT!61DB820B22C0
Malwarebytes	Trojan.MalPack.GS
Sangfor	Ransom.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HOQK
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Dropper.LokiBot-9940755-0
Kaspersky	HEUR:Backdoor.Win32.Mokes.gen
BitDefender	Gen:Variant.Ransom.Loki.412
NANO-Antivirus	Trojan.Win32.Mokes.jqzszb
Avast	Win32:AceCrypter-K [Cryp]
Tencent	Trojan.Win32.Strab.ya
Sophos	Mal/Agent-AWV
F-Secure	Heuristic.HEUR/AGEN.1312669
DrWeb	Trojan.Siggen17.19859
VIPRE	Gen:Variant.Ransom.Loki.412
TrendMicro	Ransom.Win32.STOP.SMYXCDGT.hp
Trapmine	suspicious.low.ml.score
Emsisoft	Trojan.Crypt (A)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanRansom.Blocker.c
Varist	W32/Kryptik.EYC.gen!Eldorado
Avira	HEUR/AGEN.1312669
MAX	malware (ai score=83)
Kingsoft	malware.kb.a.999
Microsoft	Trojan:Win32/Azorult.RFA!MTB
Arcabit	Trojan.Ransom.Loki.412
ZoneAlarm	HEUR:Backdoor.Win32.Mokes.gen
GData	Win32.Trojan.Kryptik.SE
Google	Detected
AhnLab-V3	Trojan/Win.MalPE.R476106
Acronis	suspicious
VBA32	Backdoor.Mokes
ALYac	Gen:Variant.Ransom.Loki.412
Cylance	unsafe
Panda	Trj/GdSda.A
Rising	Trojan.Kryptik!1.DC53 (CLASSIC)
Ikarus	Trojan.Crypter
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenericKDZ.6BC4!tr
Cybereason	malicious.dcb5fa
DeepInstinct	MALICIOUS