LokiBot credential theft with aPLib compression and HTTP C2 exfiltration
Detects the LokiBot information stealer by identifying its characteristic aPLib compressed payloads, specific C2 URI patterns, known C2 infrastructure, and credential theft routines targeting applications like 1Password, Keepass, and WinBox.
YARA
