⚠️ Overview

Loki (Mythic) is an information-stealing malware first documented in 2015, attributed to the threat actor TA544, and later adapted to use the open-source Mythic C2 framework for encrypted communications. Classified as an infostealer, it primarily targets credentials from web browsers, email clients, FTP applications, and cryptocurrency wallets, as described in MITRE ATT&CK entry S0443.

🔧 Technical Capabilities

Loki propagates via phishing emails with malicious macro-enabled documents or executable attachments that download the payload from remote servers. Its C2 infrastructure originally used HTTP, FTP, or SMTP protocols, but recent variants leverage the Mythic framework's AES-encrypted channels to evade network detection. Persistence is achieved through registry Run keys and scheduled tasks. Evasion techniques include packing with UPX, obfuscation via XOR encoding, and disabling security software through process injection. Loki steals browser credential stores (Chrome, Firefox, Edge), FTP client configurations (FileZilla, WinSCP), email client settings (Outlook, Thunderbird), and cryptocurrency wallet directories. It also collects system information for reconnaissance, including hostname, username, OS version, and installed antivirus products.

📜 History & Notable Incidents

Loki first appeared in underground crimeware forums in 2015, sold as a modular stealer kit. Major campaigns between 2017 and 2019, documented by Proofpoint and Cisco Talos, targeted financial, healthcare, and manufacturing sectors in Europe and North America, infecting tens of thousands of endpoints. No specific CVEs are associated with Loki, as it relies on social engineering rather than software exploits. Law enforcement actions have not been publicly reported against its operators, though the malware's source code was leaked in 2018, leading to multiple variants.

🔍 Detection Indicators

Known Loki file hashes include SHA256 e4a5c7d1f2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8 (example; real hashes are available on VirusTotal). Behavioral indicators include file writes to %APPDATA%LocalTemp with randomly named .exe files, creation of mutex GlobalLoki_0, and network connections to IP addresses over port 80 or 443 with User-Agent strings mimicking Firefox 60.0. Registry persistence keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun containing the malware path are common.

☠️ Risk & Impact

Loki exfiltrates stored credentials, enabling account takeovers, data breaches, and financial theft. Organizations with weak email security are at highest risk; losses from credential theft can lead to lateral movement and ransomware deployment. The malware has affected diverse sectors, including finance, healthcare, and manufacturing, as reported by threat intelligence vendors.

🛡️ Mitigation

Defenders should deploy email gateway filtering to block macro attachments, implement endpoint detection rules for Loki-specific IOCs (e.g., mutex, registry keys, file paths), and enforce multi-factor authentication. Regular security awareness training and application whitelisting reduce infection risk. MITRE ATT&CK S0443 provides additional detection recommendations.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.