Loading malware…
LokiBot is a credential-stealing malware family primarily associated with Windows infections and commonly tracked as an infostealer. It is known for harvesting credentials from web browsers, including Safari and Chromium- and Firefox-based browsers, and for collecting host information such as the current username and domain name. LokiBot has also been observed using keylogging to capture user input and transmitting stolen data to command-and-control infrastructure for exfiltration.
Operationally, LokiBot employs multiple execution and evasion techniques. It has used malicious Office macros and VBScript-based components to trigger execution, including lures that prompt victims to enable content in email-delivered attachments. It has also abused Windows Installer through msiexec.exe as part of execution chains. For stealth and defense evasion, LokiBot has used process hollowing and shellcode execution via Windows APIs such as LoadLibrary, GetProcAddress, and CreateRemoteThread. It has embedded PowerShell commands inside batch scripts, used scheduled task abuse including invocation of SilentCleanup, and modified the Windows Registry as part of UAC bypass activity. Additional observed behaviors include copying itself into hidden files or directories and deleting dropped artifacts after privilege-bypass steps.
The malware is widely associated with commodity cybercrime activity focused on credential theft and follow-on fraud rather than a single exclusive threat actor. Its tradecraft aligns with phishing-driven malware campaigns targeting end users and organizations through malicious document attachments and script-based loaders.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The 77.doc file is an obfuscated RTF file, which exploits another Microsoft Office vulnerability, CVE-2017-11882... The Microsoft Equation Editor process that can be identified in the sandbox analysis is a strong indicator that the vulnerability is indeed CVE-2017-11882, which is a vulnerability in Microsoft Equation Editor. | The purpose of this campaign is to deploy the Lokibot stealer on the infected machines.
The malicious document is a xlsx file that contains a blurred image... The document tries to exploit a vulnerability found in Microsoft Office and WordPad, that is described in CVE-2017-0199. If successful, the malware would download a file found at http[:]//itssotiny.com/fYYbO. | The purpose of this campaign is to deploy the Lokibot stealer on the infected machines.
In a recent FortiGuard Labs investigation, we came across several malicious Microsoft Office documents designed to exploit known vulnerabilities. Specifically, CVE-2021-40444 and CVE-2022-30190 are remote code execution vulnerabilities. | LokiBot, also known as Loki PWS, has been a well-known information-stealing Trojan active since 2015. It primarily targets Windows systems and aims to gather sensitive information from infected machines.
Specifically, CVE-2021-40444 and CVE-2022-30190 are remote code execution vulnerabilities. Exploiting these vulnerabilities allowed the attackers to embed malicious macros within Microsoft documents that, when executed, dropped the LokiBot malware onto the victim's system. | LokiBot, also known as Loki PWS, has been a well-known information-stealing Trojan active since 2015. It primarily targets Windows systems and aims to gather sensitive information from infected machines.
The malicious web page exploits a vulnerability identified as CVE-2016-0189 to run the embedded PowerShell script. | We recently detected an aggressive malware distribution campaign delivering LokiBot via multiple techniques, including the exploitation of older vulnerabilities.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
An email campaign attempting to distribute the Lokibot password-stealing malware used a message attempting to spoof company emails on COVID-19 response policy as a lure.
[👽TA] TA558 (🏴): Steganography using other malwares (AgentTesla, FormBook, Remcos, LokiBot, GuLoader or XWorm)
The info stealers most popular with SilverTerrier last year were LokiBot (446 unique samples/month), Pony (330 unique samples/month), and Agent Tesla .NET keylogger (95 unique samples/month).
The group relied exclusively on a variety of publicly available spyware and Remote Access Trojans (RATs), including AgentTesla, Lokibot, AzoRult, Pony, and NetWire.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
This report details a specific phishing campaign used to distribute the Agent Tesla RAT. The lure in the emails is centered around updates to COVID-specific PPE.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The injector is written in Visual Basic (VB) | the second type included a VBA script that executed a macro immediately upon opening the document.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
including the exploitation of older vulnerabilities... RTF: Exploitation of CVE-2017-11882 ... Internet Explorer: Exploitation of CVE-2016-0189 | Internet Explorer: Exploitation of CVE-2016-0189 | RTF: Exploitation of CVE-2017-11882
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Lokibot is usually protected by at least one obfuscation technique.
attached installers that usually posed as documents related to financial transactions
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
The covered campaigns have primarily been engineered for credential harvesting. Some utilize commodity malware, where others simply redirect to weaponized phishing sites.
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.
The payloads of the campaigns using both types of installers delivered the same families of remote administration tool (RAT) and information stealing malware, and they shared the same command and control (C&C) infrastructure.
2,919 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
165 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An infostealer that steals credentials from browsers, FTP clients, and other applications, exfiltrates them to C2 via compressed POST requests, and can receive commands to download additional malware or run a keylogger.
Commodity credential-stealing malware used in COVID-themed phishing campaigns.
LokiBot is discussed as malware using C2 infrastructure; the article traces infrastructure pivots starting from a domain identified as a LokiBot C2.
Credential-stealing malware that harvests usernames and passwords from more than a hundred applications, including browsers, cryptocurrency wallets, email clients, and FTP tools. In this campaign it is delivered via a phishing email with a JScript attachment, followed by PowerShell, an in-memory .NET injector, and process injection into aspnet_compiler.exe. It compresses stolen data with aPLib and sends it to a command-and-control server, and may attempt persistence via a registry run key.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.