Categories: Malware

Should I remove “Troj/LokiBot-EB”?

The Troj/LokiBot-EB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Troj/LokiBot-EB virus can do?

Executable code extraction
Creates RWX memory
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine Troj/LokiBot-EB?


File Info:
crc32: 9DA24024md5: e1b74e825c840d5205989ef0344910bbname: loki.exesha1: 00671d335b0e4636e809315b1e92583e0ac06c69sha256: f767831e5211083b12c553edb8e98eba8cbbe31abb8968cf5f4ac59443635fc7sha512: 6e11f50e101078f6f9838ea95ca6ec77c0a3d3c23b93389ba79d120d36cf3f0a15070ba332b736a960080aa89d1611cebb61f2b60eb3dcd31b4010a39c0c746bssdeep: 24576:KCdxte/80jYLT3U1jfsWaeoYvB93YygmB0vdfcFZQ:Lw80cTsjkWaevvBjgdtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0809 0x04b0

Troj/LokiBot-EB also known as:

DrWeb	Trojan.PWS.Stealer.21240
MicroWorld-eScan	Trojan.PasswordStealer.GenericKD.41896740
FireEye	Generic.mg.e1b74e825c840d52
CAT-QuickHeal	Backdoor.Androm
ALYac	Backdoor.Androm.gen
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 0055998e1 )
BitDefender	Trojan.PasswordStealer.GenericKD.41896740
K7GW	Trojan ( 0055998e1 )
Cybereason	malicious.35b0e4
Arcabit	Trojan.PasswordStealer.Generic.D27F4B24
TrendMicro	TrojanSpy.AutoIt.LOKI.AM
BitDefenderTheta	Gen:NN.ZexaCO3.32250.dvW@a8jkwhii
Cyren	W32/Arrakis.MRBT-3833
Symantec	Packed.Generic.548
APEX	Malicious
Avast	AutoIt:Injector-JE [Trj]
GData	Trojan.PasswordStealer.GenericKD.41896740
Kaspersky	Backdoor.Win32.Androm.titd
NANO-Antivirus	Trojan.Win32.Androm.gdmkts
ViRobot	Trojan.Win32.S.Agent.1109504.T
AegisLab	Trojan.Win32.Androm.m!c
Rising	Trojan.Obfus/Autoit!1.BD7E (CLASSIC)
Ad-Aware	Trojan.PasswordStealer.GenericKD.41896740
Sophos	Troj/LokiBot-EB
Comodo	Malware@#1hnpfjhatoc6k
F-Secure	Trojan.TR/AD.LokiBot.poqsp
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Downloader.tc
Emsisoft	Trojan.PasswordStealer.GenericKD.41896740 (B)
Ikarus	Trojan.Autoit
F-Prot	W32/Autoit.AEX
Webroot	W32.Trojan.Gen
Avira	TR/AD.LokiBot.poqsp
Antiy-AVL	GrayWare/Autoit.Execute.a
Microsoft	Trojan:Win32/Pwsteal.Q!bit
Endgame	malicious (moderate confidence)
ZoneAlarm	Backdoor.Win32.Androm.titd
AhnLab-V3	Malware/Win32.Generic.R294758
McAfee	Artemis!E1B74E825C84
MAX	malware (ai score=100)
Malwarebytes	Trojan.MalPack.AutoIt
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Injector.Autoit.EKQ
TrendMicro-HouseCall	TrojanSpy.AutoIt.LOKI.AM
SentinelOne	DFI – Malicious PE
Fortinet	AutoIt/Injector.EKY!tr
AVG	AutoIt:Injector-JE [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_80% (W)
Qihoo-360	HEUR/QVM10.2.8C87.Malware.Gen