Procedure examples

Lokibot has the ability to discover the domain name of the infected host.

Lokibot has obfuscated strings with base64 encoding.

Lokibot has used several packing methods for obfuscation.

Lokibot has the ability to discover the username on the infected host.

Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.

Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.

Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.

Lokibot has used process hollowing to inject itself into legitimate Windows process.

Lokibot has the ability to capture input on the compromised host via keylogging.

Lokibot has used PowerShell commands embedded inside batch scripts.

Lokibot has used cmd /c commands embedded within batch scripts.

Lokibot has used VBS scripts and XLS macros for execution.

Lokibot will delete its dropped files after bypassing UAC.

Lokibot has used HTTP for C2 communications.

Lokibot has the ability to discover the computer name and Windows product name/version.

Lokibot can search for specific files on an infected host.

Lokibot downloaded several staged items onto the victim's machine.

Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.

Lokibot has modified the Registry as part of its UAC bypass process.

Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.

Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.

Lokibot has performed a time-based anti-debug check before downloading its third stage.

Lokibot has utilized multiple techniques to bypass UAC.

Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.

Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.

Lokibot has the ability to copy itself to a hidden file and directory.

Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.

Lokibot has reflectively loaded the decoded DLL into memory.