Lokibot

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Comprehensive Credential Harvesting: LokiBot targets a vast array of software. It decrypts and extracts saved passwords from web browsers (Chrome, Firefox, Edge, Safari), FTP/SFTP clients (FileZilla, WinSCP), email clients (Outlook, Thunderbird), and specialized IT administration tools (PuTTY, RDP connections).
• Cryptocurrency Theft: It actively searches the file system for local cryptocurrency wallet files (`wallet.dat`) and attempts to steal the private keys for Bitcoin, Ethereum, and other major altcoins.
• Evasion and Exfiltration: The malware often uses process hollowing (e.g., injecting into `vbc.exe`) to evade antivirus detection. It compresses and encrypts the stolen data, typically exfiltrating it to a Command and Control (C2) server via HTTP POST requests using a hardcoded, distinct user-agent string.

Threat Assessment

Incident Response and Remediation

• Mandatory Credential Reset: The absolute highest priority is an immediate, global password reset for all accounts associated with the compromised user. Because it steals VPN and RDP credentials, these must be secured instantly to prevent secondary breaches.
• MFA Enforcement: Ensure strict Multi-Factor Authentication (MFA) is enforced across all external-facing corporate portals to neutralize the threat of the stolen passwords being reused.
• C2 Blockade and EDR Triage: Block all known LokiBot C2 IP addresses at the corporate firewall. Utilize EDR to ensure the executable is completely removed and verify no secondary payloads were downloaded before quarantine.

Known aliases

Threat reports may refer to this family under multiple names:

• InfoStealer.LokiBot
• Trojan-PSW.Win32.Loki
• Loki PWS

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1056.001 T1555 T1048

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_LOKIBOT {
    meta:
        description = "Detects Lokibot (spyware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "lokibot" ascii wide nocase
        $s2 = "infostealer.lokibot" ascii wide nocase
        $s3 = "trojan-psw.win32.loki" ascii wide nocase
        $s4 = "loki pws" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Lokibot Activity
id: 20eb1f82621001883ea0c2085aff5729
status: experimental
description: Detects generic indicators of the lokibot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*lokibot*"
            - "*infostealer.lokibot*"
            - "*trojan-psw.win32.loki*"
            - "*loki pws*"
    condition: selection
level: medium

References & External Analysis

• MITRE ATT&CK: Lokibot (S0447)
• Search "lokibot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: spyware)

Explore other malware families in the same category:

• Relevantknowledge
• Formbook

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/lokibot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.