LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0447: Lokibot

Lokibot is a widely distributed information stealer that was first reported in 2015. It is designed to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials. Lokibot can also create a backdoor into infected systems to allow an attacker to install additional payloads.[1][2][3]

EnterpriseS0447MalwareObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Lokibot matters because ATT&CK describes it as a Windows information stealer focused on usernames, passwords, cryptocurrency wallets, and other credentials, with the ability to create a backdoor for additional payloads. For leaders, the practical risk is not just malware cleanup; it is potential credential compromise, follow-on access, and uncertainty about what accounts, wallets, systems, or data paths may have been exposed.

Executive priority

Prioritize Lokibot-style scenarios where credential theft would disrupt operations, enable unauthorized access, or weaken audit confidence. Executives should ask whether the organization can quickly identify affected Windows endpoints, determine which credentials may have been captured, validate outbound web-based command-and-control or exfiltration evidence, and coordinate password/key rotation with incident response. Because ATT&CK links Lokibot to techniques for persistence, stealth, discovery, credential access, exfiltration, and additional payload transfer, response plans should assume endpoint containment and identity remediation must happen together.

Technical view

ATT&CK provides no official detection text for Lokibot, so defenders should validate coverage through its documented relationships rather than a single malware signature. On Windows, prioritize visibility for malicious-file execution, PowerShell and Windows Command Shell use, Visual Basic execution, scheduled task creation, registry modification, process hollowing indicators, keylogging-related behavior, host/user/file/network discovery, file deletion, packed or obfuscated artifacts, deobfuscation activity, web-protocol C2, exfiltration over C2, and ingress tool transfer. Treat the SilverTerrier relationship as threat-intelligence context, not proof of attribution in any local incident.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • PowerShell execution logs and script block/module logging where available
  • Windows Scheduled Task creation and modification events
  • Windows Registry modification telemetry
  • Endpoint detection telemetry for process injection or process hollowing patterns

Detection direction

  • Map detections to the ATT&CK relationships instead of relying only on Lokibot names or hashes, since obfuscation and software packing are documented behaviors.
  • Correlate suspicious user-driven file execution with follow-on command shell, PowerShell, Visual Basic, scheduled task, registry, discovery, and outbound web traffic activity.
  • Tune for sequences that combine credential-access behavior such as keylogging with system/user discovery and C2/exfiltration indicators.
  • Review blind spots around encrypted or common web protocols, packed executables, deleted artifacts, and process-hollowing behaviors that may reduce signature-only visibility.
  • Separate administrative false positives from suspicious activity by checking parent process, user context, execution path, task name, registry path, destination reputation, and whether the behavior follows a newly opened file.

Mitigation priorities

  • Harden the user-execution path for malicious files through attachment handling, endpoint protection, and user-awareness controls appropriate to the environment.
  • Reduce credential exposure by enforcing strong identity controls, rapid credential rotation procedures after suspected compromise, and monitoring for abnormal account use.
  • Constrain and monitor PowerShell, command shell, Visual Basic, scheduled tasks, and registry changes on Windows endpoints.
  • Improve egress governance by monitoring and controlling outbound web-protocol traffic and investigating unusual C2-like destinations.
  • Ensure incident response playbooks cover endpoint isolation, malware artifact preservation, credential impact assessment, and follow-on payload hunting.
Additional notes and limits

Lokibot is described by ATT&CK as a widely distributed information stealer first reported in 2015. The supplied relationships show use of multiple techniques across execution, persistence, privilege escalation, defense evasion/stealth, discovery, credential access, collection, command and control, and exfiltration. The object itself lists Windows as the platform and does not specify tactics or aliases. External references include CISA, Infoblox, Morphisec, Talos, and MITRE ATT&CK.

MITRE did not provide official detection guidance in the supplied object. This take does not assert current exploitation, local exposure, successful compromise, or guaranteed detection. Local conclusions require endpoint, identity, network, and incident evidence from the environment being assessed.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Lokibot

Lokibot is a widely distributed information stealer that was first reported in 2015. It is designed to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials. Lokibot can also create a backdoor into infected systems to allow an attacker to install additional payloads.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1059.005Visual BasicSub-technique

Lokibot has used VBS scripts and XLS macros for execution.[4]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.[4]

EnterpriseT1027.002Software PackingSub-technique

Lokibot has used several packing methods for obfuscation.[1]

EnterpriseT1027Obfuscated Files or Information

Lokibot has obfuscated strings with base64 encoding.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.[4]

EnterpriseT1555Credentials from Password Stores

Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.[1]

EnterpriseT1620Reflective Code Loading

Lokibot has reflectively loaded the decoded DLL into memory.[4]

EnterpriseT1055.012Process HollowingSub-technique

Lokibot has used process hollowing to inject itself into legitimate Windows process.[1][4]

EnterpriseT1033System Owner/User Discovery

Lokibot has the ability to discover the username on the infected host.[5]

EnterpriseT1083File and Directory Discovery

Lokibot can search for specific files on an infected host.[4]

EnterpriseT1056.001KeyloggingSub-technique

Lokibot has the ability to capture input on the compromised host via keylogging.[5]

EnterpriseT1059.003Windows Command ShellSub-technique

Lokibot has used cmd /c commands embedded within batch scripts.[4]

EnterpriseT1112Modify Registry

Lokibot has modified the Registry as part of its UAC bypass process.[4]

EnterpriseT1053.005Scheduled TaskSub-technique

Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.[4]

EnterpriseT1497.003Time Based ChecksSub-technique

Lokibot has performed a time-based anti-debug check before downloading its third stage.[4]

EnterpriseT1041Exfiltration Over C2 Channel

Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.[5]

EnterpriseT1053Scheduled Task/Job

Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.[4]

EnterpriseT1548.002Bypass User Account ControlSub-technique

Lokibot has utilized multiple techniques to bypass UAC.[4]

EnterpriseT1082System Information Discovery

Lokibot has the ability to discover the computer name and Windows product name/version.[5]

EnterpriseT1106Native API

Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.[4]

EnterpriseT1564.001Hidden Files and DirectoriesSub-technique

Lokibot has the ability to copy itself to a hidden file and directory.[1]

EnterpriseT1059.001PowerShellSub-technique

Lokibot has used PowerShell commands embedded inside batch scripts.[4]

EnterpriseT1016System Network Configuration Discovery

Lokibot has the ability to discover the domain name of the infected host.[5]

EnterpriseT1070.004File DeletionSub-technique

Lokibot will delete its dropped files after bypassing UAC.[4]

EnterpriseT1204.002Malicious FileSub-technique

Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.[6][4]

EnterpriseT1071.001Web ProtocolsSub-technique

Lokibot has used HTTP for C2 communications.[1][4]

EnterpriseT1105Ingress Tool Transfer

Lokibot downloaded several staged items onto the victim's machine.[4]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.[1]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1555: Credentials from Password StoresEnterpriseuses · TechniqueT1620: Reflective Code LoadingEnterpriseuses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1053: Scheduled Task/JobEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1564.001: Hidden Files and DirectoriesEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
3d9c6a4f57f60025...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundle3d9c6a4f57f6…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  2. [2]
    Morphisec Lokibot April 2020

    Cheruku, H. (2020, April 15). LOKIBOT WITH AUTOIT OBFUSCATOR + FRENCHY SHELLCODE. Retrieved May 14, 2020.

    Open source URL
  3. [3]
    CISA Lokibot September 2020

    DHS/CISA. (2020, September 22). Alert (AA20-266A) LokiBot Malware . Retrieved September 15, 2021.

    Open source URL
  4. [4]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  5. [5]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  6. [6]
    TrendMicro Msiexec Feb 2018

    Co, M. and Sison, G. (2018, February 8). Attack Using Windows Installer msiexec.exe leads to LokiBot. Retrieved April 18, 2019.

    Open source URL
  7. [7]
    Unit42 SilverTerrier 2018

    Unit42. (2016). SILVERTERRIER: THE RISE OF NIGERIAN BUSINESS EMAIL COMPROMISE. Retrieved November 13, 2018.

    Open source URL
  8. [8]
    CISA Lokibot September 2020

    DHS/CISA. (2020, September 22). Alert (AA20-266A) LokiBot Malware . Retrieved September 15, 2021.

    Open source URL
  9. [9]
    CISA Lokibot September 2020

    DHS/CISA. (2020, September 22). Alert (AA20-266A) LokiBot Malware . Retrieved September 15, 2021.

    Open source URL
  10. [10]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  11. [11]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  12. [12]
    Lokibot

    (Citation: Infoblox Lokibot January 2019)(Citation: Morphisec Lokibot April 2020)(Citation: Talos Lokibot Jan 2021)

  13. [13]
    Lokibot

    (Citation: Infoblox Lokibot January 2019)(Citation: Morphisec Lokibot April 2020)(Citation: Talos Lokibot Jan 2021)

  14. [14]
    Lokibot

    (Citation: Infoblox Lokibot January 2019)(Citation: Morphisec Lokibot April 2020)(Citation: Talos Lokibot Jan 2021)

  15. [15]
    Morphisec Lokibot April 2020

    Cheruku, H. (2020, April 15). LOKIBOT WITH AUTOIT OBFUSCATOR + FRENCHY SHELLCODE. Retrieved May 14, 2020.

    Open source URL
  16. [16]
    Morphisec Lokibot April 2020

    Cheruku, H. (2020, April 15). LOKIBOT WITH AUTOIT OBFUSCATOR + FRENCHY SHELLCODE. Retrieved May 14, 2020.

    Open source URL
  17. [17]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  18. [18]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  19. [19]
    mitre-attackS0447
    Open source URL
  20. [20]
    mitre-attackS0447
    Open source URL
  21. [21]
    mitre-attackS0447
    Open source URL
  22. [22]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  23. [23]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  24. [24]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  25. [25]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  26. [26]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  27. [27]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  28. [28]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  29. [29]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  30. [30]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  31. [31]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  32. [32]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  33. [33]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  34. [34]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  35. [35]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  36. [36]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  37. [37]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  38. [38]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  39. [39]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  40. [40]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  41. [41]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  42. [42]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  43. [43]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  44. [44]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  45. [45]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  46. [46]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  47. [47]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  48. [48]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  49. [49]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  50. [50]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  51. [51]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  52. [52]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  53. [53]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  54. [54]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  55. [55]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  56. [56]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  57. [57]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  58. [58]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  59. [59]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  60. [60]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  61. [61]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  62. [62]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  63. [63]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  64. [64]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  65. [65]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  66. [66]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  67. [67]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  68. [68]
    FSecure Lokibot November 2019

    Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.

    Open source URL
  69. [69]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  70. [70]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  71. [71]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  72. [72]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  73. [73]
    TrendMicro Msiexec Feb 2018

    Co, M. and Sison, G. (2018, February 8). Attack Using Windows Installer msiexec.exe leads to LokiBot. Retrieved April 18, 2019.

    Open source URL
  74. [74]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
  75. [75]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  76. [76]
    Talos Lokibot Jan 2021

    Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.

    Open source URL
  77. [77]
    Infoblox Lokibot January 2019

    Hoang, M. (2019, January 31). Malicious Activity Report: Elements of Lokibot Infostealer. Retrieved May 15, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use