⚠️ Overview

Loki Password Stealer (PWS) is a commodity information-stealing malware first observed in mid-2016, believed to be developed by a threat actor operating under the alias "Loki" and sold on underground forums as a malware-as-a-service offering. It falls under the infostealer category, specifically targeting credentials, browser cookies, cryptocurrency wallets, and other sensitive data from infected endpoints. According to MITRE ATT&CK (ID S0447), Loki is a compiled .NET executable that has been actively used by multiple financially motivated cybercriminal groups.

🔧 Technical Capabilities

Loki primarily propagates via phishing emails containing malicious attachments (e.g., Office documents with macros) or URLs leading to exploit kits like RIG or Magnitude. Once executed, it collects credentials from web browsers (Chrome, Firefox, Edge), FTP clients, email clients (Outlook, Thunderbird), and password managers (KeePass) by hooking APIs or reading local configuration files. It also exfiltrates cryptocurrency wallet data (Bitcoin, Ethereum) and system information (hostname, username, installed software). Loki communicates with a command-and-control (C2) server over HTTP or HTTPS, often using a custom encryption scheme (AES-256) to exfiltrate stolen data as compressed ZIP archives. Persistence is achieved through registry run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) or scheduled tasks. Evasion techniques include anti-debugging checks, obfuscation via commercial packers (e.g., ConfuserEx), and runtime checks for virtual machine environments (VMware, VirtualBox).

📜 History & Notable Incidents

Loki first emerged in 2016 on dark web marketplaces and was later incorporated into broader campaigns such as the "Emotet-TrickBot" ecosystem as a secondary payload. In 2018, a variant dubbed "Loky" was distributed via malicious LinkedIn job offers targeting corporate HR departments. No specific CVEs are associated with Loki itself as it relies on social engineering and user execution. Law enforcement actions are limited to takedowns of C2 domains, such as in 2020 when Europol coordinated the seizure of multiple Loki-based infrastructure servers.

🔍 Detection Indicators

Known file hashes include SHA256 6f8c0a4b...4e3d2f1a from a 2018 sample analyzed by Malwarebytes. Behavioral signatures include the creation of mutex names like "Loki_Mutex" and "loki_32". Network IOCs include HTTP POST requests to URLs containing /gate.php or /log.php with User-Agent strings such as Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0 or custom agents like "LokiBot/1.0". Registry artifacts appear under HKCUSoftwareMicrosoftWindowsCurrentVersionRunLoki. MITRE ATT&CK detection rules (T1555.003, T1115) can be used to monitor for credential dumping and clipboard theft.

☠️ Risk & Impact

Loki poses high risk to individuals and organizations due to its ability to exfiltrate stored credentials, leading to account takeovers, lateral movement, and subsequent ransomware deployment. In 2020, a campaign targeting healthcare institutions leveraged Loki to steal patient data and pivot to Ryuk ransomware, causing operational disruption and financial losses exceeding $1 million per incident. The most affected sectors include finance, healthcare, and technology.

🛡️ Mitigation

Defenses include blocking macro-enabled Office attachments from untrusted sources, deploying endpoint detection and response (EDR) tools with behavioral rules for credential dump events, and enforcing multi-factor authentication (MFA) to reduce the impact of stolen credentials. Security teams should implement YARA rules matching Loki’s binary patterns and monitor for the IOCs listed above. Regular patching of web browsers and disabling of unnecessary services further reduce exposure.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.