Loki: a new private agent for the popular Mythic framework

Description

Kaspersky researchers discovered a previously unknown Loki backdoor, utilized in a series of targeted attacks. Analysis revealed that Loki is a private version of an agent compatible with the open-source Mythic framework. The malware employs techniques like memory encryption, indirect system API calls, and API function hashing to impede analysis. It comprises a loader and a DLL, with the latter implementing core functionalities. The loader gathers system information and communicates with the command-and-control server to obtain the payload DLL. Loki inherits commands from various Mythic agents and supports capabilities like file transfers, code injection, and token management. Attackers likely distribute the malware via email, targeting Russian companies across multiple industries.