Lokibot

Lokibot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Type
Stealer
Origin
ex-USSR territory
First seen
3 May, 2015
Last seen
30 September, 2020
Also known as
Loki
LokiPWS
Global rank
3
Week rank
7
Month rank
6
IOCs
17777

What is Lokibot malware?

Lokibot, also known as Loki-bot or Loki bot, is an information stealer malware that collects data from most widely used web browsers, FTP, email clients and over a hundred software tools installed on the infected machine. It was developed in one of the ex-USSR countries.

It was discovered for the first time on May 3rd, 2015 from a sale announcement made by the creator and the malware is still active to this day.

General description of Lokibot

Initially created and sold by a hacker known as "lokistov," or "Carter,", the first versions of Lokibot spyware used to cost up to $400. However, soon after almost identical malware started appearing on hacker forums, available for as little as $80 from a number of sellers. As it is thought, “lokistov” himself was hacked, and the source code of the virus was leaked, allowing others to make and sell extremely similar malware.

Curiously, a researcher subsequently found out that the first version of the virus got patched by someone without accessing the source code, which gave the hacker community the ability to set a series of individual domains used to receive the retrieved data.

Even though several versions of the virus exist today, it was found that all of them are actually modifications of the original malware. Interestingly, the server to which Lokibot stealer sends data is unique for every particular malware sample.

Lokibot malware analysis

A video displaying the simulation of the contamination process created by the ANY.RUN interactive malware hunting service provides the perfect opportunity to see how the contamination process is unfolding on an infected machine. As shown in the simulation, Lokibot needs email attachments, such as a Microsoft Office file or an archive file to be opened in order to enter an active phase.

process graph of lokibot stealer execution Figure 1: Process graph generated by the ANY.RUN malware hunting service

The malware life cycle can be broken down to the following stages:

  • Contamination. The victim downloads an infected archive or a Microsoft Office file which eventually downloads the malware;
  • Being packed initially, the Keylogger unpacks itself and begins the execution of the main payload;
  • The virus creates unique loop-functions for each application that it is targeting and saves retrieved data into a buffer;
  • Then, a registry key is modified and the Trojan is copied specifically into a folder with a specific name unique name under %APPDATA% folder. This allows the virus to establish persistence. MachineGuid MD5 is used for the name generation and the name can also be used as a Mutex as well as bot-id. As the last action of this step, the virus generates a registry key that points to the file it copied before to the specific folder inside the %APPDATA% folder;
  • Then, depending if the current user is privileged or not the virus sets persistence either under HKEY_LOCAL_MACHINE or KEY_CURRENT_USER;
  • Next, general system information is sent to the C&C server;
  • For persistence, the keylogger then applies triple DES encryption to the URL and the registry key;
  • After this the virus starts waiting for commands from C&C, creating a new thread to detect the C&C response.

How to avoid infection by Lokibot?

Since Lokibot spyware requires macros to be activated to infect the system, attackers will do everything in their power to make the victim enable them. Thus keeping macros turned off is the best bet to stay protected from the Trojan. Particularly, extra caution should be exhibited when a document downloaded from a suspicious source or an unknown email address prompts to enable macros.

In addition, having antivirus software from trusted developers and always keeping it updated is a good way to decrease the probability of becoming the malware’s victim. Another good common practice is to be extremely mindful when opening attachments or clicking links in emails from unidentified sources.

Distribution of Lokibot

Lokibot stealer is distributed mostly via mail-spam campaigns, prompting the user to download an infected file that is attached. Particularly, the three most commonly used types of files are Microsoft Office documents configured to begin the download and installation processes of the malware, archive files that contain a Loki-Bot executable or ISO files, also containing a Loki-Bot executable.

Lokibot execution process

Interactive sandbox simulation conducted on the ANY.RUN malware hunting service allows us to take a closer look at how the execution process of Lokibot unfolds in a case when a contaminated Microsoft Office file is the infection source.

  • The simulation starts with opening a Microsoft Office file. Immediately, WINWORD.EXE is executed with enable macros.
  • Then, through the exploitation of the CVE-2017-11882 vulnerability, Microsoft Office Equation Editor proceeds to download a malicious executable file;
  • Finally, a malicious executable file runs itself and then proceeds to steal the personal data and connect to the C&C server.

process tree of a lokibot stealer execution Figure 2: Illustrates the execution processes of Lokibot as shown by ANY.RUN simulation

a text report of a lokibot analysis Figure 3: A text report created by ANY.RUN

The virus generates multiple artifacts during its execution process. Particularly, four types of files can be simultaneously stored in the secret %APPDATA% directory at any point in time. Those files can have a “.exe,” “.lck,” “.hdb” or a “.kdb.” extensions and each file type is used for a specific purpose:

  • .exe files contain an executable copy of the Trojan that triggers when a user logs into an account,
  • .lck files are generated in order to prevent resource conflicts when either Windows Credentials or Keylogging are decrypted,
  • .hdb files are used to store the hashes of all data samples already transmitted to the C&C server
  • .kdb files are in turn used to hold information about the data that is yet to be sent to the server

The keylogger uses the following algorithm to name the files:

  1. First, Lokibot takes the value of MachineGuid from the registry branch HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Cryptography . In the case of our simulation, it was set to dc5131b5-5fbc-4f85-b1ed-28d4392080ca.

lokibot mutex creation GUID registry

  1. Then, the virus uses the MD5 algorithm to calculate the hash sum of the MachineGuid which in our case ended up being c83ba0aa282a966263dda560052b3caf.

lokibot mutex creation md5

  1. Finally, characters from the 8th to the 13th of the resulting hash amount are used as the name of the subdirectory, and the characters from the 13th to the 18th are used as the name of the files.

lokibot mutex creation

Communication with C&C

To communicate with the C&C server, the patched version of the virus which is also the most widely spread strain sends a “ckav.ru” string. Interestingly, the sent data is also is a substring of “fuckav.ru”.

How to detect Lokibot using ANY.RUN?

Among other things you can detect either it is Lokibot in front of you or not by looking inside sending packets - there's always text "ckav.ru" inside them. Just click on the sent packet in "HTTP REQUESTS" tab and take a look inside a packet.

lokibot network stream Figure 4: Lokibot network stream

Conclusion

Not lastly due to the fact that the first version of the malware was leaked and cloned, eventually becoming available for a significantly cheaper price than the original, Lokibot spyware became a widely spread malware that is continuing to appear in several mail-spam campaigns. In fact, the virus has become so popular that it’s set-up explanation videos are publically available on YouTube.

Fortunately, modern malware hunting tools like ANY.RUN provides the ability to examine the malware behavior in detail and establish solid protection against the hazard.

IOCs

IP addresses
37.140.192.185
204.11.56.48
68.66.216.20
104.27.189.177
104.28.15.236
111.118.215.98
104.18.48.42
185.118.166.155
192.168.100.100
124.156.18.43
104.28.17.182
209.99.40.222
103.253.212.225
148.163.124.15
103.26.43.131
103.221.223.15
103.221.223.15
104.27.184.50
192.236.199.171
192.169.69.25
Hashes
3c5ec2709804c74634f656733d79f79e15e89e401a601f20f779c1b2f107e085
0c3572f66544d34a86aff962081fee6904569d791d6a7489afdb645581197e24
213036cea81909f061d67141c3da1794eb03c5a7a5a8f0b5ed6671e614ce7b45
d38216ff448c391387ca8b2fa70ab98f466ca10a9b4c80436315bc77fbd08bf1
517c5435417e2a0cc41308357f20a767c419d1142365350ceaa2b38d2d3019f4
de1949f8433037884c645971feb3103a4d290f501363be29185ba2017019e83e
647876f0489b8a495cf15cd5890e867e9ada62ed76b9d881b41e250573cc454e
3d91122cc7afca161a7e5a2f856ac9f37f41429a7cccac4bee3a5739169fbb7f
442ff2c321be17a406aac89773f0ef511d612b8029ed7d98ca1c0a17f58852a9
8f8b737cb257334806ab6ed42f9597765b86c578223fea359a24342e76e57005
e99423804a3b66e3ed9b29093ef6e0037d1d1a2dcd869c2af6395cd85f10d8d0
a3a88fcb28494a7288b2f53e508130452222c3afe41687864ebf08c6fa7a9ca1
bc9084e36a37d02f116740df25e23a40ef3902a3e2da11cc94861f5a71d31377
5b46483a724fa7ce85a59dbc18d3c4994fae183a778db9452f0fd443d9f369ab
68830a24fb818aea27e54e97f4dec890d751166eecb7c02ea3cb03c823e5fe65
c14115b27dcc8a6e26ce22be191d64ee3c74a9e812ae8409a2a834e05542aa1f
8bc689d070d0991e960d0d6323c6bcdd557bc31cfb72514bac81f82dfc1d5d84
71d5a2f560de370fc12c29bbc17d96f4859afbfced53892392655c1a096bc5ff
295d6f6cf0375f79f9a308ebc193b3403fa87db488586f5a273f70354249f8ad
fc27d5975a0b1b0f856f57dd5839cd081efde7a6fc228a5ddbdb57ef4bf1a9c3
Domains
app.backinstock.org
notis.ru
hamaker.net
89gospel.com
load.csell.co
musk-giveaway.com
epsondriversforwindows.com
kuriero.pro
kl-df-d.com
fdmail85.club
emergingit.com
www.emergingit.com
nvisionsigns.com
www.cssrvsync.com
www.admotion.com
oceanlinen.com
buzzkillmedia.com
bookstower.com
majul.com
www.proxyocean.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More