Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Ransom
Threat report

Trojan.Ransom.Loki.EWT information

Published Mar 3, 2024 Ransom category 3 min read
Report context

What to verify before removal

Trojan.Ransom.Loki.EWT information should be handled as a recovery-sensitive report, not as a routine deletion task. Before removing files, isolate the affected system and compare the detection with the notes below so encrypted data, restore points, and backups are not damaged.

Start by comparing the local file name with E9CB900E57154D6469DA.mlw, then review the behavior notes for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
E9CB900E57154D6469DA.mlw
  • Compare the suspicious file name with E9CB900E57154D6469DA.mlw.
  • Confirm the detection name matches Trojan.Ransom.Loki.EWT information before removing related files.
  • Review the report for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers so the cleanup is based on observed behavior, not only the label.
  • Disconnect the machine from the network before recovery work and avoid deleting encrypted samples until backups are checked.

The Trojan.Ransom.Loki.EWT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Trojan.Ransom.Loki.EWT virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Tswana
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the RedLine malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan.Ransom.Loki.EWT?



File Info:

name: E9CB900E57154D6469DA.mlw
path: /opt/CAPEv2/storage/binaries/583b0791a0ba67d9dd1c0f542d8224a8293e767b8fb4c4308a0797d8a01d6989
crc32: 464CBA52
md5: e9cb900e57154d6469dae21c82a1753b
sha1: 6abf731b90c11ffbd3406aa6b89261cc9596fefd
sha256: 583b0791a0ba67d9dd1c0f542d8224a8293e767b8fb4c4308a0797d8a01d6989
sha512: 68074b342f0bc0ceb43a37269335c3edca82fc5f803f0cb59b2afcdf9477ad83951cea441717eb8a89977e171b7488e1d0d4603c90b8962d83111a37e8dc70d2
ssdeep: 6144:njpyL/e9qd1R8l41vGQFbkyuaWUqdMnEx5FErfj1kz+NLjkUhh:nEre9qdj8ehFb7u1M4Erfj6iNs2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T151840121B792C0F3C19619308464EBB09BFFA4322574B54B7F590BAE5F703C15AAE35A
sha3_384: 9824fa5fd47c45283d1df778116021e5a7bcc2e0a391527e6efb0036713ee2cfe00f4dd5465bf37a8e2eb408e30e32d4
ep_bytes: e8744e0000e979feffff8bff51c70194
timestamp: 2021-08-01 06:48:57


Version Info:

FileVersions: 68.78.22.74
InternationalName: povgwaoci.iwe
Copyright: Copyright (C) 2022, somoklos
ProjectVersion: 19.7.84.84

Trojan.Ransom.Loki.EWT also known as:

Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Loki.l!c
tehtris Generic.Malware
MicroWorld-eScan Trojan.Ransom.Loki.EWT
FireEye Generic.mg.e9cb900e57154d64
CAT-QuickHeal Trojan.RaccoonRI.S28979458
Skyhigh BehavesLike.Win32.Lockbit.fc
McAfee RDN/RedLineStealer
Malwarebytes Generic.Malware.AI.DDS
VIPRE Trojan.Ransom.Loki.EWT
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 0040eff71 )
Alibaba TrojanSpy:Win32/Raccoon.247c28e9
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_100% (W)
VirIT Trojan.Win32.GenusT.DKEE
Symantec Trojan Horse
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HRHP
APEX Malicious
ClamAV Win.Packed.Pwsx-9975723-0
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Trojan.Ransom.Loki.EWT
NANO-Antivirus Trojan.Win32.Stealer.jtgbkc
Avast Win32:PWSX-gen [Trj]
Tencent Trojan.Win32.Obfuscated.gen
Emsisoft Trojan.Ransom.Loki.EWT (B)
F-Secure Heuristic.HEUR/AGEN.1316833
DrWeb Trojan.PWS.Stealer.34567
Zillya Trojan.Kryptik.Win32.4222014
TrendMicro Ransom.Win32.STOP.SMYACKFT
Trapmine malicious.moderate.ml.score
Sophos Troj/Krypt-SY
SentinelOne Static AI – Malicious PE
MAX malware (ai score=100)
GData Trojan.Ransom.Loki.EWT
Jiangmin Backdoor.Tofsee.gag
Webroot W32.Trojan.FL
Google Detected
Avira HEUR/AGEN.1316833
Varist W32/Kryptik.HUW.gen!Eldorado
Antiy-AVL Trojan/Win32.Sabsik
Xcitium Malware@#1h022la769pmq
Arcabit Trojan.Ransom.Loki.EWT
ZoneAlarm HEUR:Trojan-Spy.Win32.Stealer.gen
Microsoft Trojan:Win32/Raccoon.RC!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R531873
Acronis suspicious
VBA32 BScope.Backdoor.Tofsee
ALYac Trojan.Ransom.Loki.EWT
Cylance unsafe
Panda Trj/Chgt.AD
Rising Trojan.Generic@AI.100 (RDML:2JI+xmO/HALvsRHtE4p0GQ)
Ikarus Trojan.SmokeLoader
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HSSC!tr
AVG Win32:PWSX-gen [Trj]
DeepInstinct MALICIOUS

How to remove Trojan.Ransom.Loki.EWT?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.