Loading malware…
LokiBot is a long-running commodity information stealer first advertised in 2015 and later proliferated through multiple forks after its source code leaked in 2018. It is primarily known for credential theft from a broad set of Windows applications, including web browsers, email clients, FTP and SFTP software, Windows credential sources, and in some variants cryptocurrency-related applications. Some reporting also attributes keylogging and expanded remote-access-style functionality to later forks, but its core role remains credential harvesting and data exfiltration.
LokiBot is commonly delivered through phishing and malspam campaigns, often using malicious attachments such as JScript, spreadsheet, or other document-based lures that rely on user execution or enabling active content. Observed campaigns have used multi-stage loaders involving obfuscated script stages, PowerShell, in-memory .NET components, and process injection into legitimate Windows processes to launch the final payload while reducing detection. LokiBot has also appeared as a payload delivered by other malware distribution services and loaders, including steganography-enabled campaigns and shellcode-based downloaders.
On infected Windows systems, LokiBot has demonstrated runtime API resolution, mutex-based single-instance control, copying itself into hidden files or directories, registry modification associated with UAC bypass or Run-key persistence attempts, and outbound communication with command-and-control infrastructure to transmit stolen data. Collected information is compressed before exfiltration in some variants. LokiBot also performs host profiling such as username discovery and has been observed using PowerShell during execution chains. Updated variants have used steganographic techniques to conceal code within image files.
LokiBot has remained prevalent for years because of its low cost, accessibility to lower-skill operators, and effectiveness in account theft operations. It has been associated with broad cybercrime activity rather than a single exclusive operator, including use in phishing-heavy ecosystems such as those linked to SilverTerrier and TA558. It continues to target organizations and individuals opportunistically across sectors wherever stolen credentials can be monetized.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Older Microsoft Office flaws (CVE-2017-11882, CVE-2017-0199) that remain unpatched in many organizations were also leveraged. | Indicators of Compromise (IoCs):- ... Malware LokiBot Infostealer deployed via legacy Office exploit chains
Older Microsoft Office flaws (CVE-2017-11882, CVE-2017-0199) that remain unpatched in many organizations were also leveraged. | Indicators of Compromise (IoCs):- ... Malware LokiBot Infostealer deployed via legacy Office exploit chains
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
[👽TA] TA558 (🏴): Steganography using other malwares (AgentTesla, FormBook, Remcos, LokiBot, GuLoader or XWorm)
The info stealers most popular with SilverTerrier last year were LokiBot (446 unique samples/month), Pony (330 unique samples/month), and Agent Tesla .NET keylogger (95 unique samples/month).
The group relied exclusively on a variety of publicly available spyware and Remote Access Trojans (RATs), including AgentTesla, Lokibot, AzoRult, Pony, and NetWire.
"...we found several different families of RATs and infostealers. These included Lokibot, Betabot, Formbook, and AgentTesla."
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Once executed, the script decodes a Base64-encoded PowerShell script, saves it to the C:\Temp folder with a random filename, and runs it.
Opening the file causes Windows to run it through the built-in Windows Script Host program. The script is heavily obfuscated using decoy functions and hexadecimal-named variables to slow down analysis.
Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
It spawns a legitimate aspnet_compiler.exe process, allocates memory inside it, and writes the final LokiBot payload into that space. This process injection technique allows the malware to run inside a trusted Windows process, making it harder to flag.
The malware also tries to establish persistence via a registry run key, but newer samples built with custom builders contain a broken persistence mechanism due to a patched decryption routine.
Avaddon modifies several registry keys for persistence and UAC bypass ... Lokibot has modified the Registry as part of its UAC bypass process ... Shamoon ... modify the Registry to disable UAC remote restrictions by setting ... LocalAccountTokenFilterPolicy to 1.
The script is heavily obfuscated using decoy functions and hexadecimal-named variables to slow down analysis... The loaded .NET assembly, protected with the ConfuserEx obfuscator, acts as an injector.
stegocampaign is a cyberattack using steganography to hide malware in images, making detection difficult.
To stay hidden, LokiBot avoids importing most Windows API functions directly and instead resolves them at runtime using a custom hashing technique.
Defense Evasion. ...Работают сразу две техники: Steganography (T1027.003) для обфускации пейлоада и Embedded Payloads (T1027.009) для сокрытия кода внутри медиафайла.
As shown in the output of the patched assembly (Figure 7), a new aspnet_compiler.exe process is spawned.
It spawns a legitimate aspnet_compiler.exe process, allocates memory inside it, and writes the final LokiBot payload into that space. This process injection technique allows the malware to run inside a trusted Windows process, making it harder to flag.
Once executed, the script decodes a Base64-encoded PowerShell script... The PowerShell stage then decrypts a .NET assembly payload using XOR with a hard-coded key.
It spawns a legitimate aspnet_compiler.exe process... This process injection technique allows the malware to run inside a trusted Windows process, making it harder to flag.
Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Banking trojans and information stealers materialized as the second most prevalent type of cybercrime, with malware families like RedLine, Lumma, LokiBot, Negasteal, and ZBot taking up the top spots.
After harvesting credentials, LokiBot compresses the stolen data using aPLib and sends it to a command-and-control server.
Every minute, it sends an HTTP request containing information about the infected system and spawns a separate thread to process the server's response and execute any received commands.
2,757 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
97 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
LokiBot is discussed as malware using C2 infrastructure; the article traces infrastructure pivots starting from a domain identified as a LokiBot C2.
Credential-stealing malware that harvests usernames and passwords from more than a hundred applications, including browsers, cryptocurrency wallets, email clients, and FTP tools. In this campaign it is delivered via a phishing email with a JScript attachment, followed by PowerShell, an in-memory .NET injector, and process injection into aspnet_compiler.exe. It compresses stolen data with aPLib and sends it to a command-and-control server, and may attempt persistence via a registry run key.
LokiBot is a long-running infostealer focused on harvesting credentials from more than a hundred software products, including browsers, cryptocurrency wallets, password managers, email clients, and FTP clients. In the analyzed campaign it was delivered via malspam as an obfuscated JScript attachment, which launched a PowerShell loader and a .NET injector before injecting the final LokiBot payload. The malware steals credentials, compresses and exfiltrates them to C2 infrastructure, establishes persistence, and polls the C2 for additional commands.
A banking trojan and information stealer listed among the most prevalent malware families in Asia and the South Pacific.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.