Ransom

Ransom.Loki.472 removal instruction

Malware Removal

The Ransom.Loki.472 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom.Loki.472 virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine Ransom.Loki.472?



File Info:

name: F1E3FE1398E8687D5A67.mlw
path: /opt/CAPEv2/storage/binaries/32c2b9fb4be32fa7224cc688f183f8f3e09973645aeb9b03eda20e122cf8fa2d
crc32: 69913399
md5: f1e3fe1398e8687d5a674c3e5b0d7147
sha1: 5740a47dad214af160f17ddde2f8254b334805c4
sha256: 32c2b9fb4be32fa7224cc688f183f8f3e09973645aeb9b03eda20e122cf8fa2d
sha512: 6e3db264d65e8719f047263c6d373c62bfbfef02f7417b57dd7406cf04ecc76ea6083a5cc7b69a9b2ab1e8c5ec9613096b9f536b9081851fc9187f33b1d10702
ssdeep: 12288:z2N8jiZ4zypIPsttPplTY6RhKucAIHKEb/yQvDdj1h+9mpNdIfRmiW2s5nH/2FcO:z2N8jiZ4zypIPstJTDERA2zyMDx1ggpy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T198D41284757F6756D8BBA3F404546A78433B68A6F233E2475F93B1CA0624F440B82F6B
sha3_384: 45238c38428ca99d8f93443b3a9b65da32e7e1d342f51f344e6fde0746c4e8ca09b1aeb080db72794725dfd71d487cd7
ep_bytes: ff250020400000000000000000000000
timestamp: 2041-02-12 17:38:11


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: QLBanMayTinh
FileVersion: 1.0.0.0
InternalName: gFAv.exe
LegalCopyright: Copyright ©  2020
LegalTrademarks: 
OriginalFilename: gFAv.exe
ProductName: QLBanMayTinh
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ransom.Loki.472 also known as:

BkavW32.AIDetectMalware.CS
LionicTrojan.Win32.Agensla.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Ransom.Loki.472
FireEyeGen:Variant.Ransom.Loki.472
SkyhighBehavesLike.Win32.Generic.jc
McAfeePWS-FDBP!F1E3FE1398E8
Cylanceunsafe
ZillyaTrojan.Taskun.Win32.8027
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 005a74e81 )
AlibabaTrojan:MSIL/Taskun.163c824e
K7GWTrojan ( 005a5dd81 )
VirITTrojan.Win32.MSIL_Heur.A
SymantecScr.Malcode!gdn34
ESET-NOD32a variant of MSIL/Kryptik.AIYV
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.MSIL.Taskun.gen
BitDefenderGen:Variant.Ransom.Loki.472
NANO-AntivirusTrojan.Win32.Stealer.jwuuuj
AvastWin32:PWSX-gen [Trj]
TencentMalware.Win32.Gencirc.13be15a0
EmsisoftGen:Variant.Ransom.Loki.472 (B)
F-SecureHeuristic.HEUR/AGEN.1365272
DrWebTrojan.PWS.Stealer.36733
VIPREGen:Variant.Ransom.Loki.472
SophosTroj/MSIL-TAP
IkarusTrojan.MSIL.Inject
GDataGen:Variant.Ransom.Loki.472
WebrootW32.Malware.Gen
GoogleDetected
AviraHEUR/AGEN.1365272
Antiy-AVLTrojan[PSW]/MSIL.Agensla
KingsoftWin32.Troj.Generic.v
XcitiumMalware@#3viqqtpwi580w
ArcabitTrojan.Ransom.Loki.472
ZoneAlarmHEUR:Trojan.MSIL.Taskun.gen
MicrosoftTrojan:Win32/Leonem
VaristW32/MSIL_Kryptik.JJW.gen!Eldorado
AhnLab-V3Trojan/Win.AgentTesla.C5432699
ALYacSpyware.AgentTesla
MAXmalware (ai score=100)
VBA32TScope.Trojan.MSIL
MalwarebytesGeneric.Crypt.Trojan.DDS
PandaTrj/Chgt.AD
RisingMalware.Obfus/MSIL@AI.100 (RDM.MSIL2:ZEZtn0Ba4oh53WdUzTpmNQ)
YandexTrojan.Igent.b0b4Cd.3
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.74644571.susgen
FortinetMSIL/GenericKDS.61009645!tr
AVGWin32:PWSX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Ransom.Loki.472?

Ransom.Loki.472 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment