LokiBot After a Decade: An Analysis of a Recent LokiBot Campaign

This report provides a focused technical analysis of a multi-stage LokiBot infostealer campaign delivered via JScript malspam. It documents the execution chain (obfuscated JScript -> Base64 PowerShell -> XOR-decrypted .NET loader -> process injection of a 32-bit LokiBot binary), describes credential-harvesting, persistence attempts, API-hashing and other TTPs, and lists IoCs (SHA256s, IP, domains, and URLs) observed in the campaign.