Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Ransom
Threat report

Ransom.Loki.9508 removal guide

Published May 6, 2024 Ransom category 3 min read
Report context

What to verify before removal

Ransom.Loki.9508 removal guide should be handled as a recovery-sensitive report, not as a routine deletion task. Before removing files, isolate the affected system and compare the detection with the notes below so encrypted data, restore points, and backups are not damaged.

Start by comparing the local file name with FED12006B4F162D03A91.mlw, then review the behavior notes for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
FED12006B4F162D03A91.mlw
  • Compare the suspicious file name with FED12006B4F162D03A91.mlw.
  • Confirm the detection name matches Ransom.Loki.9508 removal guide before removing related files.
  • Review the report for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers so the cleanup is based on observed behavior, not only the label.
  • Disconnect the machine from the network before recovery work and avoid deleting encrypted samples until backups are checked.

The Ransom.Loki.9508 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Ransom.Loki.9508 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Marathi
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the RedLine malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom.Loki.9508?



File Info:

name: FED12006B4F162D03A91.mlw
path: /opt/CAPEv2/storage/binaries/5dfddd84b4b756b40536129b708958f388abb6f2f355021180078d0b1859b6d5
crc32: B6FA9D3A
md5: fed12006b4f162d03a91cb0ecfe6ab57
sha1: 3ee2488099f7a1fca56fdeea3a4683dd34a4f7f9
sha256: 5dfddd84b4b756b40536129b708958f388abb6f2f355021180078d0b1859b6d5
sha512: df46d1dcba5874362f5cc1701d3bcef571747cdd6215eee037f59389261b6d9f7fcc74d7e66cccc4aef3183469e98ecf86a8035f83913c561f81826bdc7ee6e8
ssdeep: 6144:Ryy4gqle3V4BsLg2HBxyqmzIS7yIDGTaDSk57EUgiga3wVf:QzDle3V4ETyBUSjsk5gUN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11284E000F6A0D834D0921E304871DAB14B7BB96265B45947F794BF2F2EB3391A6B631F
sha3_384: 8c46b00b0ec00907e20678cb882f5e944fda2df151a864427d0d5e5874d6977bbd4057915d16557c5ecfc041fadc282d
ep_bytes: e87e560000e989feffff8bff558bec8b
timestamp: 2021-03-26 08:33:25


Version Info:

FileVersions: 29.47.75.23
Copyrighz: Copyright (C) 2022, pozkarte
ProjectVersion: 28.82.74.73

Ransom.Loki.9508 also known as:

Bkav W32.AIDetectMalware
Lionic Trojan.Win32.StopCrypt.4!c
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Steam.28320
MicroWorld-eScan Gen:Variant.Ransom.Loki.9508
FireEye Generic.mg.fed12006b4f162d0
Skyhigh BehavesLike.Win32.Lockbit.fh
McAfee RDN/Real Protect-PEE
Cylance unsafe
Zillya Trojan.Kryptik.Win32.3769235
Sangfor Ransom.Win32.Save.a
K7AntiVirus Trojan ( 0056d16b1 )
Alibaba Ransom:Win32/StopCrypt.e267f8ab
K7GW Trojan ( 0056d16b1 )
Arcabit Trojan.Ransom.Loki.D2524
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Kryptik.HPQV
APEX Malicious
TrendMicro-HouseCall Ransom_StopCrypt.R002C0DB524
Paloalto generic.ml
ClamAV Win.Packed.Jaik-9950927-0
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Ransom.Loki.9508
NANO-Antivirus Trojan.Win32.Stealer.jowpgu
Avast Win32:RansomX-gen [Ransom]
Tencent Trojan.Win32.Stealer.zj
Emsisoft Gen:Variant.Ransom.Loki.9508 (B)
F-Secure Heuristic.HEUR/AGEN.1316833
VIPRE Gen:Variant.Ransom.Loki.9508
TrendMicro Ransom_StopCrypt.R002C0DB524
Trapmine malicious.high.ml.score
Sophos Mal/Agent-AWV
Ikarus Trojan.Win32.Raccrypt
Jiangmin Trojan.DiskWriter.ave
Webroot W32.Trojan.Gen
Google Detected
Avira HEUR/AGEN.1316833
Varist W32/Kryptik.GSB.gen!Eldorado
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft malware.kb.a.1000
Xcitium Malware@#20pd2x6hswkv5
Microsoft Ransom:Win32/StopCrypt.PBO!MTB
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Win32.Trojan.Kryptik.TA
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.MalPE.R493299
Acronis suspicious
VBA32 Malware-Cryptor.InstallCore.6
ALYac Gen:Variant.Ransom.Loki.9508
Malwarebytes Trojan.MalPack.GS
Panda Trj/Genetic.gen
Rising Trojan.Kryptik!8.8 (TFE:5:x3eJuL0C5BE)
MAX malware (ai score=87)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.ERHN!tr
AVG Win32:RansomX-gen [Ransom]
DeepInstinct MALICIOUS
alibabacloud Malware

How to remove Ransom.Loki.9508?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.