How to remove “Trojan:Win32/Lokibot.ANRF!MTB”?

The Trojan:Win32/Lokibot.ANRF!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Lokibot.ANRF!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• At least one process apparently crashed during execution
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Created a process from a suspicious location
• CAPE detected the AgentTeslaV3 malware family

How to determine Trojan:Win32/Lokibot.ANRF!MTB?

File Info:
name: 847509CAEC10838A3DC4.mlw
path: /opt/CAPEv2/storage/binaries/8c67d7bb05889f9901371a0559205d0cd562f9600299994c24b7ccf8c98c902b
crc32: 53F697E2
md5: 847509caec10838a3dc47f7bbe87c7ec
sha1: 49fbcd444fbd4ac1886363c311067e6d444a513a
sha256: 8c67d7bb05889f9901371a0559205d0cd562f9600299994c24b7ccf8c98c902b
sha512: f61865a2d600dd036ac62787d10f452c7b863e87b812cbc59314fc888da1b004749178c1b92c748923e2c71d69dcffa5c220b2d25f4f9c213d751b9673c54ca2
ssdeep: 6144:LOtIOfevFgjBBjR78GJ2bRnaLbP7x5RX7/UnglGNgUCrRvknQNR+:LOLWvF6jp8GJ2bRav7xvUngodAMnI4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D86423306390C5B3CA724E364D77A7368AFBAF790072594F13C4AACD7D36280875DA65
sha3_384: 450c33395b0b69e126650fbb47e3992870c3871e5bfc304f12f191f9cf0843b77895f5ba1f4d903c1415cf9561a89176
ep_bytes: 558bec81ecf40300005356576a205f33
timestamp: 2021-09-25 21:54:49

Version Info:
0: [No Data]

Trojan:Win32/Lokibot.ANRF!MTB also known as:

How to remove Trojan:Win32/Lokibot.ANRF!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.