Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Ransom
Threat report

How to remove “Trojan.Ransom.Loki.CLT”?

Published Feb 26, 2024 Ransom category 3 min read
Report context

What to verify before removal

How to remove “Trojan.Ransom.Loki.CLT”? should be handled as a recovery-sensitive report, not as a routine deletion task. Before removing files, isolate the affected system and compare the detection with the notes below so encrypted data, restore points, and backups are not damaged.

Start by comparing the local file name with ED8096260C9F7DE506BA.mlw, then review the behavior notes for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
ED8096260C9F7DE506BA.mlw
  • Compare the suspicious file name with ED8096260C9F7DE506BA.mlw.
  • Confirm the detection name matches How to remove “Trojan.Ransom.Loki.CLT”? before removing related files.
  • Review the report for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers so the cleanup is based on observed behavior, not only the label.
  • Disconnect the machine from the network before recovery work and avoid deleting encrypted samples until backups are checked.

The Trojan.Ransom.Loki.CLT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Trojan.Ransom.Loki.CLT virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan.Ransom.Loki.CLT?



File Info:

name: ED8096260C9F7DE506BA.mlw
path: /opt/CAPEv2/storage/binaries/8b18ae1d0cdc76bff21cb3a55e0e0a9280bd0979bcc049426381f71b2e06d924
crc32: 392F4257
md5: ed8096260c9f7de506bac0f750d947cc
sha1: 479cfd3114958272b579c3d5c1bce522d304ddd3
sha256: 8b18ae1d0cdc76bff21cb3a55e0e0a9280bd0979bcc049426381f71b2e06d924
sha512: b9af3bf57a093bd8e54847033095ab20689a0f2b29a5114e9607a4af4221ec21e932b6bde4018ec4582ed6659cc707f3ad85a26486336ed9ee2007813457df39
ssdeep: 12288:Jq+O8lpXU5ZkXrWmY0EuOHVFq+gUZBfHtevxcLbtA7h17adDXJg6ot7g2gYnt87/:Jq9mY/uOHDBDPAvxAJ6h17adDcRPtc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T105159E4483484F2CF6E0367D30693EC62E8158DCE9AEBBEF8D67D879B4E845507D6902
sha3_384: 88864946262994865df539477da1e7fd34dae8d692f295ea22e9bcd109ab44daa54d3b0aa52b5c420c4e9a54372631d1
ep_bytes: ff2500204000295c8fc2f528dc3f295c
timestamp: 2023-03-13 00:37:12


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: Wealthy Ideas
FileDescription: MORG GUI
FileVersion: 1.2.0.0
InternalName: xnr.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: xnr.exe
ProductName: MORG-GUI
ProductVersion: 1.2.0.0
Assembly Version: 1.0.0.0

Trojan.Ransom.Loki.CLT also known as:

Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Stealer.12!c
tehtris Generic.Malware
CAT-QuickHeal Trojan.GenericFC.S30114760
Skyhigh BehavesLike.Win32.Generic.cc
ALYac Trojan.Ransom.Loki.CLT
Cylance unsafe
VIPRE Trojan.Ransom.Loki.CLT
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Trojan.Ransom.Loki.CLT
K7GW Riskware ( 00584baa1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Ransom.Loki.CLT
VirIT Trojan.Win32.Genus.ODT
Symantec Scr.Malcode!gdn34
Elastic malicious (high confidence)
ESET-NOD32 a variant of MSIL/Kryptik.AIIC
APEX Malicious
Kaspersky HEUR:Backdoor.MSIL.Androm.gen
Alibaba Backdoor:MSIL/Androm.0b7c03b9
NANO-Antivirus Trojan.Win32.Androm.jvmdrg
MicroWorld-eScan Trojan.Ransom.Loki.CLT
Avast Win32:PWSX-gen [Trj]
Tencent Malware.Win32.Gencirc.13b75cda
Emsisoft Trojan.Ransom.Loki.CLT (B)
F-Secure Heuristic.HEUR/AGEN.1309705
DrWeb Trojan.Siggen20.3796
Zillya Backdoor.Androm.Win32.84291
TrendMicro TROJ_GEN.R002C0DK223
Trapmine suspicious.low.ml.score
FireEye Generic.mg.ed8096260c9f7de5
Sophos Troj/Krypt-VT
SentinelOne Static AI – Malicious PE
Google Detected
Avira HEUR/AGEN.1309705
MAX malware (ai score=89)
Antiy-AVL Trojan[PSW]/MSIL.Stealer
Kingsoft Win32.Hack.Undef.a
Xcitium Malware@#8g8g15eslrv7
Microsoft Trojan:MSIL/AgentTesla.ALY!MTB
ZoneAlarm HEUR:Backdoor.MSIL.Androm.gen
GData Trojan.Ransom.Loki.CLT
Varist W32/MSIL_Kryptik.JAZ.gen!Eldorado
AhnLab-V3 Malware/Win.Generic.C5394502
McAfee PWS-FDPH!ED8096260C9F
VBA32 TScope.Trojan.MSIL
Malwarebytes Generic.Crypt.Trojan.DDS
Panda Trj/Chgt.AD
Zoner Trojan.Win32.154374
TrendMicro-HouseCall TROJ_GEN.R002C0DK223
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:MWZPy6sqYldjweRKUaf2MQ)
Ikarus Trojan.MSIL.Inject
MaxSecure Trojan.Malware.73691364.susgen
Fortinet MSIL/Kryptik.AIIC!tr
AVG Win32:PWSX-gen [Trj]
DeepInstinct MALICIOUS

How to remove Trojan.Ransom.Loki.CLT?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.