Spyware.LokiBot.AutoIt (file analysis)

The Spyware.LokiBot.AutoIt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Spyware.LokiBot.AutoIt virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Authenticode signature is invalid

How to determine Spyware.LokiBot.AutoIt?


File Info:
name: 0BFE5B2D1333911B35C0.mlw
path: /opt/CAPEv2/storage/binaries/189056ecd40062a3d7ac15f1ba0bfacef5cb168213d22d9365ba79cb17528d09
crc32: D474E81F
md5: 0bfe5b2d1333911b35c078192e8a63ed
sha1: c0ff2aef86e91faa14202a267e974c26b13d1719
sha256: 189056ecd40062a3d7ac15f1ba0bfacef5cb168213d22d9365ba79cb17528d09
sha512: 4f466d27fc7072616a538bbbf166cccb2075fb71005475d5289a47015ba42d060b0c8358ecd07250b1a2d3fcf85dd0db8f4953ef45e9d79097889b64229f0623
ssdeep: 12288:dCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga4dGKbirJFQ:dCdxte/80jYLT3U1jfsWa4rbidFQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AF159E22B3DDC360CB669173BF6A77017EBF78650630B85B2F881D79AE50161162C7A3
sha3_384: 1a240e86cb3c2ab02050bcdb1eac29ad485201067e135ed6a148648365282bd68514f8867ca4ac151f21526403e903cd
ep_bytes: e8b8d00000e97ffeffffcccccccccccc
timestamp: 2020-05-02 09:14:57

Version Info:
Translation: 0x0809 0x04b0

Spyware.LokiBot.AutoIt also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.4!e
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop6.49883
MicroWorld-eScan	Trojan.GenericKD.34062279
FireEye	Trojan.GenericKD.34062279
ALYac	Trojan.GenericKD.34062279
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 005679111 )
Alibaba	TrojanDownloader:AutoIt/Lokibot.c1f74641
K7GW	Trojan ( 005679111 )
Cybereason	malicious.d13339
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/Autoit.OKA
Kaspersky	HEUR:Trojan-Dropper.Win32.Autoit.gen
BitDefender	Trojan.GenericKD.34062279
NANO-Antivirus	Trojan.Win32.Autoit.hmqtwd
Avast	Script:SNH-gen [Trj]
Ad-Aware	Trojan.GenericKD.34062279
Emsisoft	Trojan.GenericKD.34062279 (B)
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.dh
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Azorult
GData	Trojan.GenericKD.34062279
Avira	HEUR/AGEN.1134149
MAX	malware (ai score=86)
Microsoft	TrojanDownloader:AutoIt/Lokibot.AR!MTB
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win32.Autoit.R338199
McAfee	Artemis!0BFE5B2D1333
VBA32	TrojanDropper.Autoit
Malwarebytes	Spyware.LokiBot.AutoIt
APEX	Malicious
Fortinet	W32/CoinMiner.1BD9!tr
Webroot	W32.Trojan.Gen
AVG	Script:SNH-gen [Trj]
Panda	Trj/CI.A

How to remove Spyware.LokiBot.AutoIt?

Spyware.LokiBot.AutoIt removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X