Loading malware…
Floki Bot is a banking trojan derived from the leaked Zeus codebase and marketed in criminal underground forums. It is not a simple Zeus clone; it incorporates a staged loader architecture and additional implementation changes while retaining core Zeus-style functionality and network protocol characteristics.
Execution begins with a loader that injects code into a legitimate Windows process, primarily explorer.exe, with fallback to another system process when needed. The injected first stage acts as a trampoline that transfers execution to a second-stage payload. Embedded payload components are stored as encrypted and compressed resources, decrypted with RC4 and decompressed with LZNT1 before the final bot component is loaded into memory. The malware uses hashed API and module resolution to hinder analysis and conceal functionality.
The final payload is a Zeus-like banking trojan that communicates with command-and-control infrastructure over HTTPS using Zeus-style BinStorage encoding. It can exfiltrate host profiling data including system identity and display characteristics. Researchers also identified partially implemented support for Tor-based command-and-control using .onion infrastructure, although that capability was not active in analyzed samples.
Floki Bot establishes persistence by copying itself under a randomized name into the user Startup folder. Memory forensics has shown its injected code, payload stages, and associated network activity running inside compromised processes. The loader was observed to emphasize stealth through concealed injection-related system call usage, though publicly documented samples did not show notable anti-debugging in the loader itself.
Floki Bot illustrates the continued criminal evolution of the Zeus ecosystem, combining classic banking trojan tradecraft with staged in-memory loading, process injection, encrypted payload handling, and HTTPS-based command-and-control on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
At every stage, the malware uses hashing to obfuscate module and function names used in dynamic library resolution.
This time the payload - the one executed after the trampoline - resolves the required APIs via the use of a CRC lookup
Once the malware is executed, it attempts to inject malicious code into 'explorer.exe' - the Microsoft Windows file manager. If it is unable to open 'explorer.exe', it will then inject into 'svchost.exe'.
The resource is encrypted with RC4, and can be decrypted with the 16 byte key data from the 'key' resource, which is passed as an argument to the injected code. Moreover, the resource is compressed with the LZNT1 algorithm, and is extracted by invoking RtlDecompressBuffer.
To achieve this, the bytes in network packets are packaged in BinStorage structures that are sent over HTTPS. Each byte in the BinStorage structure is XOR'd by the previous byte and then additionally encrypted with RC4.
The main difference is support for the Tor network that should be activated when the C2 domain specified in the malware configuration ends with '.onion' which is the pseudo TLD for Tor related domains.. When this is the case, a standard Tor proxy server is configured to listen on localhost:9050
34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.