LokiBot Final Payload – PE32 with 'x' Section 3DES C2 Config

Duo Tech@duotech

•updated Jun 30, 2026•0•0•0

Detects the final payload stage of LokiBot infostealer, characterized by a 32-bit Windows PE file built with MSVC 2015. The rule identifies specific known malicious file hashes or a structural signature featuring a non-standard PE section named 'x', which is used by the malware to store 3DES-encrypted C2 endpoint addresses.