LokiBot is a persistent infostealer that first surfaced in 2015. Despite a slight reduction in activity over recent years, it remains a formidable threat due to its affordability and wide-ranging capabilities.
A recent campaign demonstrates that attackers continue to rely on LokiBot to steal credentials from over 100 software products, including browsers, cryptocurrency wallets, and email clients.
This latest variant employs a complex, multi-stage delivery mechanism to evade detection.
LokiBot Uses Obfuscated Loaders
The attack begins with a standard malspam campaign containing a malicious JScript attachment. When a victim executes the file, the Windows Script Host processes highly obfuscated code that interleaves decryption routines with decoy functions.
This initial script decodes a Base64-encoded PowerShell payload, saves it to the temporary folder, and executes it. The script utilizes ActiveX to interact with the system.
It includes a cleanup function that deletes evidence if an execution timeout is reached.
The PowerShell script acts as a simple .NET assembly loader. It performs XOR decryption using a hard-coded key to reveal a Base64-encoded .NET assembly, which is then reflectively loaded into memory.
Control flow redirects to a designated method that receives the path for the Microsoft ASP.NET compiler and a large byte array. This hands the infection process over to the third stage, an .NET injector protected by ConfuserEx.
Once decompiled and deobfuscated, the .NET assembly reveals a classic process injection mechanism.
It spawns a new instance of the ASP.NET compiler, allocates memory within the process, and writes the previously supplied byte array into it using standard Windows API functions.
The injected code is the final LokiBot payload, a 32-bit executable compiled in 2015. To evade analysis, the malware resolves required API addresses at runtime using a custom hashing technique rather than importing them directly.
Upon successful injection, LokiBot verifies it is the only active instance by creating a mutex based on the MD5 hash of the system’s MachineGuid.
It then launches a dedicated credential-harvesting routine that iterates through targeted software.
Stolen data is compressed using aPLib and exfiltrated to a command-and-control (C2) server. Afterward, the malware enters a loop, pinging the server every minute to await further instructions, levelblue said.
Interestingly, this LokiBot variant features a broken persistence mechanism. It copies itself to the AppData directory and attempts to create a Run key in the registry.
However, because custom builders patched a decryption subroutine to return the C2 address constantly, the malware writes the wrong path to the registry, effectively failing to establish persistence upon system reboot.
LokiBot Campaign Indicators of Compromise
| Indicator Type | Value |
|---|---|
| Filename | gruijvdsdbcmcvbtryedfhpoibbedflokjqnb.js |
| SHA256 Hash | c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb |
| SHA256 Hash | 64c7dd0a3a3ae49977ac05913d3878000cce14e5d8c1ee05b782bdfd648bde91 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
