defection.io

malware

Lokibot S0447

Type: malware
Platform: Windows
Created: 14 May 2020
Last modified: 25 April 2025

Lokibot is a widely distributed information stealer that was first reported in 2015. It is designed to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials. Lokibot can also create a backdoor into infected systems to allow an attacker to install additional payloads.[1][2][3]

TechniquesTop 9%

TacticsTop 2%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

Lokibot S0447

Type: malware
Platform: Windows
Created: 14 May 2020
Last modified: 25 April 2025

TechniquesTop 9%

TacticsTop 2%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Lokibot MITRE reference S0447

System Network Configuration Discovery T1016 ↗

Lokibot has the ability to discover the domain name of the infected host.4

Discovery25 detection rules

Obfuscated Files or Information T1027 ↗

Lokibot has obfuscated strings with base64 encoding.5

Stealth117 detection rules

Software Packing T1027.002 ↗

Lokibot has used several packing methods for obfuscation.6

Stealth1 detection rules

System Owner/User Discovery T1033 ↗

Lokibot has the ability to discover the username on the infected host.7

Discovery47 detection rules

Exfiltration Over C2 Channel T1041 ↗

Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.8

Exfiltration16 detection rules

Scheduled Task/Job T1053 ↗

Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.9

Execution · Persistence · Privilege Escalation19 detection rules

Standing S0447

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques28Top 9%

91st percentile · 91% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics11Top 2%

98th percentile · 98% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique29.5med74th pct

74th percentile · 74% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique9medTop 19%

81st percentile · 81% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1.5med65th pct

65th percentile · 65% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 28 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 849Splunk ESCU (cumulative) · 405