{
  "family": "hploki",
  "sample_count": 58,
  "category": "infostealer",
  "description": "HpLoki (cataloged across threat intelligence feeds and security vendors under detections including Trojan:Win32/HpLoki, Trojan:Win32/HpLoki!rfn, Trojan-PSW.Win32.Loki, and PWS:Win32/Lokibot) is a pervasive Windows information-stealing trojan and reconnaissance backdoor belonging to the wider LokiBot malware ecosystem. Active since 2015, HpLoki is distributed via malspam email campaigns harboring password-protected archive attachments (ZIP, RAR, 7z), ISO disk images, and weaponized Microsoft Office documents exploiting vulnerabilities such as CVE-2017-11882. Upon initial execution, HpLoki injects its payload into legitimate Windows system processes such as vbc.exe or svchost.exe to bypass host-based endpoint detection. The malware systematically scans local storage to extract stored credentials, session cookies, and authentication tokens from over 100 applications, including Google Chrome, Mozilla Firefox, Microsoft Edge, Opera, FileZilla, PuTTY, WinSCP, Microsoft Outlook, and Thunderbird. Furthermore, HpLoki harvests cryptocurrency wallet keys and machine configuration profiles before compressing and exfiltrating stolen telemetry to remote C2 command servers via HTTP POST requests.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/HpLoki",
    "Trojan:Win32/HpLoki!rfn",
    "Trojan-PSW.Win32.Loki",
    "PWS:Win32/Lokibot",
    "Win32/HpLoki"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/HpLoki?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "HpLoki is an information-stealing trojan from the LokiBot family designed to harvest passwords, session cookies, and credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does HpLoki infect target systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It infects computers via spearphishing emails carrying malicious Office documents, archive attachments, and ISO image files."
      }
    },
    {
      "@type": "Question",
      "name": "What specific software applications are targeted by HpLoki?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It steals credentials from web browsers, email clients like Outlook, FTP utilities like FileZilla, and crypto wallets."
      }
    },
    {
      "@type": "Question",
      "name": "How does HpLoki evade detection by endpoint security solutions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It employs process hollowing to inject malicious code into legitimate processes like svchost.exe and encrypts its strings."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended remediation protocol for an HpLoki infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected machine, run full antimalware scanning, terminate injected processes, and force global password resets."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1055.012",
    "T1555.003",
    "T1555.004",
    "T1056.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.004",
      "name": "Credentials from Password Stores: Windows Credential Manager",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active exfiltration of the harvested credential archives.",
    "Force a global, mandatory password reset for the compromised user, prioritizing corporate VPN access, email accounts, and financial portals.",
    "Capture a full forensic memory image to extract the active Hploki payload and identify the specific C2 infrastructure it is communicating with.",
    "Assume all locally saved passwords have been compromised; perform a clean OS rebuild to ensure the infostealer is completely eradicated."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected, as the infostealer may include keylogging capabilities.",
    "Avoid assuming the threat is contained just by removing the executable; the exfiltrated passwords must be reset globally."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Crime",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Exploit-Laden Office Documents (CVE-2017-11882)",
    "Malicious ISO & Archive Bundles"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Password Harvesting",
    "Email Client Credential Theft",
    "FTP / SSH Session Stealing",
    "Process Hollowing Injection",
    "Cryptocurrency Wallet Theft"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)",
      "Office Document Exploit Stager"
    ],
    "network_signatures": [
      "HTTP POST requests transmitting XOR-encoded credentials to remote C2 gate scripts",
      "HTTP beacons containing machine GUIDs and stolen account dumps"
    ],
    "evasion_techniques": [
      "Process hollowing into legitimate Windows binaries",
      "Encrypted configuration blocks and API hashing",
      "Anti-debugging checks via IsDebuggerPresent"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\HpLoki\\bin.exe",
        "%Temp%\\svchost_stub.exe"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HpLokiUpdater",
        "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\LokiAgent"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "LokiBot"
    ],
    "variants": [
      "HpLoki.A",
      "HpLoki.RFN"
    ]
  },
  "iocs": {
    "file_hashes": [
      "a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0",
      "b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef01"
    ],
    "delivery": [
      "invoice_payment_remittance.iso",
      "swift_order_specifications.doc"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HpLokiUpdater"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/HpLoki",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/HpLoki"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan-PSW.Win32.Loki",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan-psw.win32.loki"
    }
  ]
}