{
  "family": "loki",
  "sample_count": 5,
  "category": "trojan",
  "description": "TrojanSpy:Win32/Loki (universally known as **LokiBot**) is one of the most prevalent, enduring, and dangerous information stealers on the cybercriminal market. Sold cheaply on underground forums, LokiBot is designed for the rapid, automated exfiltration of a massive variety of sensitive data, including web browser passwords, cryptocurrency wallets, FTP credentials, email accounts, and SSH keys. It is a favored tool for both low-level cybercriminals and advanced APT groups as an initial data-gathering mechanism.<br><br><b>Understanding LokiBot (Information Stealer)</b><br>To an end-user, a LokiBot infection is completely silent; the malware executes, steals the data in seconds, and often terminates itself to avoid detection. For a SOC analyst, LokiBot is a severe credential compromise event. Because it targets so many different applications, a single infection can lead to the compromise of the user's personal bank accounts, corporate VPN access, and server infrastructure (via stolen FTP/SSH keys).<br><br><b>Execution and Credential Harvesting Mechanics</b><br>LokiBot is heavily distributed via malicious spam campaigns (malspam) containing weaponized Office documents (macros) or archived executables (`T1566.001`). It is also frequently dropped by exploit kits. Upon execution, it uses Process Hollowing (`T1055.012`), often injecting its payload into a legitimate Windows process like `vbc.exe` or `explorer.exe`. Once running in memory, LokiBot iterates through a massive hardcoded list of target applications (Chrome, Firefox, Outlook, FileZilla, PuTTY, Bitcoin Core, etc.), querying their specific credential storage locations and decrypting the stored passwords (`T1555`). It packages the stolen data into a compressed archive and exfiltrates it to a C2 server via HTTP POST requests (`T1048.003`), often accompanied by a distinct user-agent string and unique hardware ID profiling the infected machine.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is catastrophic credential loss leading to immediate account takeovers and lateral movement. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing' and rapid, unauthorized access to browser SQLite databases (like `Login Data`) and email credential stores. Network IoCs include outbound HTTP POST traffic containing specific URL patterns (e.g., `fre.php` or `five/fre.php`) associated with default LokiBot C2 panels.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1048.003",
    "T1555.003",
    "T1055.012"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1048.003",
      "name": "Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (HTTP POST)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Assume ALL credentials stored on the machine (browsers, email, FTP, SSH, crypto wallets) have been compromised. Force immediate, enterprise-wide password resets for the user.",
    "Isolate the endpoint to prevent further exfiltration or the downloading of secondary payloads (LokiBot can sometimes act as a downloader).",
    "Identify the C2 domain/IP from network logs and block it across the enterprise; use this to hunt for other infected machines.",
    "Audit VPN and external portal logs for the recently stolen credentials to detect immediate attempts at lateral movement by the attackers."
  ],
  "what_to_avoid": [
    "Do not assume the network is safe just because the AV deleted the initial dropper; LokiBot harvests and exfiltrates credentials in a matter of seconds.",
    "Avoid relying solely on file-based scanning; memory forensics is often required to analyze the hollowed process and extract the LokiBot C2 configuration."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}