What is “Ransom.Loki.880”?

The Ransom.Loki.880 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Loki.880 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Uses Windows utilities for basic functionality
• HTTPS urls from behavior.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Urdu (Pakistan)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Attempts to identify installed AV products by installation directory
• Attempts to modify proxy settings
• Creates a copy of itself
• Uses suspicious command line tools or Windows utilities

How to determine Ransom.Loki.880?

File Info:
name: 886F67ABB465E64A178C.mlw
path: /opt/CAPEv2/storage/binaries/4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333
crc32: 468BF0C9
md5: 886f67abb465e64a178c5a9f465fae0c
sha1: d9b9deab1f4526a9204122509bf4eec058085fd7
sha256: 4f02ec5b51fe36f5becf6e4cc5e41855d7351e8d6fab1353126e4b4e7b133333
sha512: cb70a0f90a642456232c1f2631fa3100a14598bc7115a155294b5fbef50d983f220fca9ce435d923074514d9fb2e4e11058532c40c5e1fea2507cb256f70cf3b
ssdeep: 6144:rlKeQHKflWYjRCutegkcWppptylkHAluDXrBN2NTAwe4:rlzQHKflWTGegkFk/KrWNTAt4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B2846C125B987874E9924E718E1FC6F46A2EB561AF657BEB17178B2F49303F1C232700
sha3_384: b02d96c0f2823de273609186a2dc233039648f81642e75c9b9115d2b37e2a4290058d6bf5505e375f41a4df8ce67d0bc
ep_bytes: e8c1700000e989feffffff3524544400
timestamp: 2022-10-17 13:04:24

Version Info:
CompanyName: LaffingDonald
FileDescriptions: NiceIncorporated
FileVersion: 1.0.0.1
LegalTrademark1: ElonGetsIt
OriginalFilename: HallwayOut.exe
ProductName: GentleCanon
Translation: 0x4014 0x0535

Ransom.Loki.880 also known as:

How to remove Ransom.Loki.880?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.