LokiBot (Malware Family)
By Fraunhofer FKIE
Archived: 2026-04-05 19:51:08 UTC
apk.lokibot (Back to overview)
LokiBot
Android banker Trojan with the standard banking capabilities such as overlays, SMS stealing. It also features
ransomware functionality. Note, the network traffic is obfuscated the same way as in Android Bankbot.
References
2024-04-15 ⋅ Positive Technologies ⋅ Aleksandr Badaev, Kseniya Naumova
SteganoAmor campaign: TA558 mass-attacking companies and public institutions all around the world
LokiBot 404 Keylogger Agent Tesla CloudEyE Formbook Remcos XWorm
2024-03-27 ⋅ Twitter (@embee_research) ⋅ Embee_research
Uncovering Malicious Infrastructure with DNS Pivoting
LokiBot XWorm
2023-08-03 ⋅ Kaspersky ⋅ Kaspersky
What’s happening in the world of crimeware: Emotet, DarkGate and LokiBot
LokiBot DarkGate Emotet
2022-07-25 ⋅ muha2xmad ⋅ Muhammad Hasan Ali
PDF Analysis of Lokibot malware
LokiBot
2022-06-29 ⋅ Github (vc0RExor) ⋅ Aaron Jornet Sales
Machete Weapons Lokibot - A Malware Report
LokiBot
2021-06-10 ⋅ ZAYOTEM ⋅ Bilal BAKARTEPE, Harun YAKUT, Sinan BAYKAN, Taha HİCRET
LokiBot Technical Analysis Report
LokiBot
2020-07-14 ⋅ SophosLabs Uncut ⋅ Markel Picado, Sean Gallagher
RATicate upgrades “RATs as a Service” attacks with commercial “crypter”
LokiBot BetaBot CloudEyE NetWire RC
https://malpedia.caad.fkie.fraunhofer.de/details/apk.lokibot
Page 1 of 2

2020-01-27 ⋅ Yoroi ⋅ Luca Mella, Luigi Martire
Aggah: How to run a botnet without renting a Server (for more than a year)
LokiBot Azorult
2017-10-01 ⋅ Threat Fabric ⋅ Niels Croese, Pham Duy Phuc, Wesley Gahr
LokiBot - The first hybrid Android malware
LokiBot
There is no Yara-Signature yet.
Source: https://malpedia.caad.fkie.fraunhofer.de/details/apk.lokibot
https://malpedia.caad.fkie.fraunhofer.de/details/apk.lokibot
Page 2 of 2