Categories: Trojan

Trojan:Win32/Lokibot.SK!eml removal guide

The Trojan:Win32/Lokibot.SK!eml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Lokibot.SK!eml virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
Executed a process and injected code into it, probably while unpacking
Detects VirtualBox through the presence of a window
Deletes its original binary from disk
Attempts to remove evidence of file being downloaded from the Internet
Network activity detected but not expressed in API logs
Checks the version of Bios, possibly for anti-virtualization
Detects VirtualBox through the presence of a file
Detects VMware through the presence of a file
Creates a copy of itself
Collects information to fingerprint the system
Anomalous binary characteristics

How to determine Trojan:Win32/Lokibot.SK!eml?


File Info:
crc32: 1DD848F3md5: 3040646545b102dd221a0db5b7f0ae45name: billiz.exesha1: fb8efb16bc8acd8cbd3caac9953b76de77af2a71sha256: 5a90266076f3e13fca69c4ee32392ec75c2b5fdc755d93ee1e7ff0404711b636sha512: 8aad29c2bdeddb5ddf569c1defa88520de0b4d180844ca929b76de01d2c4d5e0f985d67072ce893672838be8d006fe6d00f146787434d4f6bbde774eaa6a403dssdeep: 12288:kQhdXfgC1uqDKWt+unU+PdzYT+ofyT+CRLw9soEf5SDywLx:DBfoqJ+Gy4nlwQuptype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Trojan:Win32/Lokibot.SK!eml also known as:

DrWeb	Trojan.PWS.Stealer.23680
MicroWorld-eScan	Trojan.Agent.ELCZ
FireEye	Generic.mg.3040646545b102dd
CAT-QuickHeal	Trojan.Multi
Qihoo-360	Win32/Backdoor.650
McAfee	Fareit-FRB!3040646545B1
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Androm.m!c
Sangfor	Malware
K7AntiVirus	Trojan ( 0055fdfe1 )
BitDefender	Trojan.Agent.ELCZ
K7GW	Trojan ( 0055fdfe1 )
Cybereason	malicious.6bc8ac
BitDefenderTheta	Gen:NN.ZelphiF.34084.NGW@aGS21wmi
F-Prot	W32/Injector.IVK
ESET-NOD32	Win32/Agent.AAIQ
APEX	Malicious
Avast	Win32:Trojan-gen
GData	Trojan.Agent.ELCZ
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
Alibaba	Backdoor:Win32/Lokibot.08a3c7ab
NANO-Antivirus	Trojan.Win32.Strictor.gytroy
ViRobot	Trojan.Win32.S.Agent.650240.AX
Tencent	Win32.Backdoor.Androm.Lgjg
Ad-Aware	Trojan.Agent.ELCZ
Sophos	Mal/Fareit-V
F-Secure	Trojan.TR/Injector.ronhi
Zillya	Trojan.Injector.Win32.683397
TrendMicro	TROJ_GEN.R067C0DB620
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jh
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.Agent.ELCZ (B)
Cyren	W32/Injector.RZAJ-2541
Webroot	W32.Malware.gen
Avira	TR/Injector.ronhi
Endgame	malicious (high confidence)
Arcabit	Trojan.Agent.ELCZ
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
AhnLab-V3	Win-Trojan/Delphiless02.Exp
ZoneAlarm	HEUR:Backdoor.Win32.Androm.gen
Microsoft	Trojan:Win32/Lokibot.SK!eml
Acronis	suspicious
ALYac	Trojan.Agent.ELCZ
MAX	malware (ai score=100)
VBA32	TScope.Trojan.Delf
Malwarebytes	Spyware.LokiBot
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R067C0DB620
Rising	Trojan.Generic@ML.100 (RDML:bcSpbrh827DJz8fZ5xuPxg)
Yandex	Trojan.AvsArher.bS82Qa
Ikarus	Trojan.Inject
eGambit	Unsafe.AI_Score_71%
Fortinet	W32/Injector.DZGI!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
MaxSecure	Trojan.Malware.1728101.susgen