Categories: Ransom

About “Ransom.Loki.7379” infection

The Ransom.Loki.7379 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Loki.7379 virus can do?

Behavioural detection: Executable code extraction – unpacking
Performs HTTP requests potentially not found in PCAP.
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Attempts to modify proxy settings
Touches a file containing cookies, possibly for information gathering
Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom.Loki.7379?


File Info:
name: FB89424C9387F22355A6.mlwpath: /opt/CAPEv2/storage/binaries/82d4849172434f0a73ceb102ca5fd57f02f0165d599001b290ffabf6b189d86ccrc32: 7407B635md5: fb89424c9387f22355a6f1318391a7ebsha1: ccec452a2bd875522e7a9c8ea6b29d9bfeb03808sha256: 82d4849172434f0a73ceb102ca5fd57f02f0165d599001b290ffabf6b189d86csha512: 3a7a3bb478475c66fcecb1c601df2319778efde9cc0a8e38002eb153f068d81e513ab89a29c4ce0a1b212aac18a36a99d68c9da163d02e2e2a611135287dd2b1ssdeep: 12288:MqsEFFGjdwHrVoedDq/lyzMbS89i7BGJ/CBCi7uT:0MFwwpoeE/lygZi1U/CBCbTtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13CE402F27281C632C6857D70A856CFA14ABFAC20C5608947F3B05B9E2F717D16A6634Fsha3_384: c748937fbeb02f3148bfe78fa3e5b31606355a5840ae387de10c07f8056087dc4d9932207d2f252b8e4eb15f7dfb58caep_bytes: e805420000e978feffff8bff558bec51timestamp: 2021-08-31 02:53:28
Version Info:
FileVersion: 21.79.127.9InternationalName: povgwaoci.iweCopyrighz: Copyrighz (C) 2022, fuzkortaTranslations: 0x0124 0x010f

Ransom.Loki.7379 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Chapak.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ransom.Loki.7379
FireEye	Generic.mg.fb89424c9387f223
CAT-QuickHeal	Ransom.Stop.P5
Skyhigh	BehavesLike.Win32.Lockbit.jc
McAfee	Lockbit-FSWW!FB89424C9387
Cylance	unsafe
Zillya	Trojan.Kryptik.Win32.3717130
Sangfor	Ransom.Win32.Save.a
K7AntiVirus	Trojan ( 0058ee0a1 )
Alibaba	Ransom:Win32/StopCrypt.96b62d8b
K7GW	Trojan ( 0058ee0a1 )
Cybereason	malicious.c9387f
Symantec	Trojan Horse
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.HONX
APEX	Malicious
ClamAV	Win.Malware.Filerepmalware-9940328-0
Kaspersky	HEUR:Trojan.Win32.Chapak.gen
BitDefender	Gen:Variant.Ransom.Loki.7379
Avast	Win32:AceCrypter-I [Cryp]
Tencent	Trojan.Win32.Mokes.xa
Emsisoft	Trojan.Crypt (A)
F-Secure	Heuristic.HEUR/AGEN.1312669
VIPRE	Gen:Variant.Ransom.Loki.7379
TrendMicro	Ransom.Win32.STOP.SMYXCDGT.hp
Trapmine	malicious.high.ml.score
Sophos	Mal/Agent-AWV
Ikarus	Trojan.Win32.Crypt
Jiangmin	Trojan.Stop.dlz
Google	Detected
Avira	HEUR/AGEN.1312669
Varist	W32/Kryptik.HKO.gen!Eldorado
Antiy-AVL	Trojan/Win32.Chapak
Microsoft	Ransom:Win32/StopCrypt.PAZ!MTB
Arcabit	Trojan.Ransom.Loki.D1CD3
ZoneAlarm	HEUR:Trojan.Win32.Chapak.gen
GData	Gen:Variant.Ransom.Loki.7379
Cynet	Malicious (score: 100)
AhnLab-V3	Spyware/Win.BeamWinHTTP.R475178
Acronis	suspicious
VBA32	BScope.Malware-Cryptor.Hlux
ALYac	Gen:Variant.Ransom.Loki.7379
MAX	malware (ai score=84)
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
Rising	Trojan.Kryptik!1.DC53 (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenericKDZ.B41B!tr
AVG	Win32:AceCrypter-I [Cryp]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan.Win.UnkAgent