Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Ransom
Threat report

Ransom.Loki.5944 removal tips

Published Mar 3, 2024 Ransom category 3 min read
Report context

What to verify before removal

Ransom.Loki.5944 removal tips should be handled as a recovery-sensitive report, not as a routine deletion task. Before removing files, isolate the affected system and compare the detection with the notes below so encrypted data, restore points, and backups are not damaged.

Start by comparing the local file name with 7B1ED269C3F3125AF4CB.mlw, then review the behavior notes for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
7B1ED269C3F3125AF4CB.mlw
  • Compare the suspicious file name with 7B1ED269C3F3125AF4CB.mlw.
  • Confirm the detection name matches Ransom.Loki.5944 removal tips before removing related files.
  • Review the report for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers so the cleanup is based on observed behavior, not only the label.
  • Disconnect the machine from the network before recovery work and avoid deleting encrypted samples until backups are checked.

The Ransom.Loki.5944 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Ransom.Loki.5944 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Presents an Authenticode digital signature
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • CAPE detected the embedded win api malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom.Loki.5944?



File Info:

name: 7B1ED269C3F3125AF4CB.mlw
path: /opt/CAPEv2/storage/binaries/1d8292a5ec108d3b33cfb402abd4476f7eeb3ed76fad46bee2e226b474462da6
crc32: D1879BBE
md5: 7b1ed269c3f3125af4cb70589ba57fcb
sha1: b5bfa02773dde7b7c9fb4f2b851f0a12d0181240
sha256: 1d8292a5ec108d3b33cfb402abd4476f7eeb3ed76fad46bee2e226b474462da6
sha512: 7f2b25e871a809613118a8f9ade7711d8140f7ceffa6e338bdabf26ff2febb07b79440c2fa1a597cdf055216cc7e9fddd1565b99d4b4676edf455cbe1a9f09e2
ssdeep: 12288:KTfx4TfxEJqazTSam0CAZMG9xv+63WiamUtIhrPSybFvT4RH3NI3l5RAOP1bwe+a:s3fR3/BLie1czIzJi9UVp/MGIy3hMCUA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AC454C35339DAA06CEC0C87A6C9A62BD0ABD5374E7F400933B467A2D5E7C4B651D312B
sha3_384: 475350f60e49ae50fed28c9d8608fc45939d330aa0db0ce65611ecfe87d987a54474c5583d23f06d035593ed48ac9cd5
ep_bytes: 6860275200e8eeffffff000000000000
timestamp: 2012-03-04 10:05:09


Version Info:

Translation: 0x0409 0x04b0
Comments: Tautochronous9
CompanyName: MENAGERIES
ProductName: CHOMBEE
FileVersion: 1.02.0003
ProductVersion: 1.02.0003
InternalName: Cceres7
OriginalFilename: Cceres7.exe

Ransom.Loki.5944 also known as:

Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ransom.Loki.5944
ClamAV Win.Packed.Vbkryjetor-7191359-0
FireEye Generic.mg.7b1ed269c3f3125a
Skyhigh Fareit-FNV!7B1ED269C3F3
McAfee Fareit-FNV!7B1ED269C3F3
Malwarebytes Trojan.MalPack.VB.Generic
Sangfor Suspicious.Win32.Save.vb
Alibaba Backdoor:Win32/Androm.caead883
Cybereason malicious.773dde
Arcabit Trojan.Ransom.Loki.D1738
BitDefenderTheta Gen:NN.ZevbaF.36744.mn1@aeWg2cbi
VirIT Trojan.Win32.VBZenPack_Heur
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.EDTQ
APEX Malicious
Cynet Malicious (score: 99)
Kaspersky HEUR:Backdoor.Win32.Androm.gen
BitDefender Gen:Variant.Ransom.Loki.5944
Avast Win32:DangerousSig [Trj]
Sophos Mal/FareitVB-V
F-Secure Heuristic.HEUR/AGEN.1336342
VIPRE Gen:Variant.Ransom.Loki.5944
TrendMicro TrojanSpy.Win32.LOKI.THBBAAI
Trapmine malicious.moderate.ml.score
Emsisoft Gen:Variant.Ransom.Loki.5944 (B)
Google Detected
Avira HEUR/AGEN.1336342
MAX malware (ai score=82)
Kingsoft malware.kb.a.996
Microsoft Worm:Win32/Gamarue
ZoneAlarm HEUR:Backdoor.Win32.Androm.gen
GData Gen:Variant.Ransom.Loki.5944
AhnLab-V3 Win-Trojan/VBMalpack.Gen
VBA32 BScope.TrojanPSW.Stealer
ALYac Gen:Variant.Ransom.Loki.5944
Cylance unsafe
Panda Trj/GdSda.A
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.THBBAAI
Rising Trojan.Injector!1.B459 (CLASSIC)
Ikarus Trojan.Crypt.Malcert
Fortinet W32/GenKryptik.FGZN!tr
AVG Win32:DangerousSig [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)

How to remove Ransom.Loki.5944?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.