LokiBot

LokiBot was developed in 2015 to steal information from a variety of applications. Despite the age, this malware is still rather popular among cybercriminals.

Type
Stealer
Origin
ex-USSR territory
First seen
3 May, 2015
Last seen
26 January, 2023
Also known as
Loki
LokiPWS
Global rank
6
Week rank
11
Month rank
13
IOCs
24605

What is LokiBot malware?

LokiBot, also known as Loki-bot or Loki bot, is an information stealer malware that collects credentials from the most widely used web browsers, FTP, email clients, and over a hundred software tools installed on the infected system. It was developed in one of the ex-USSR countries.

The trojan was discovered for the first time on May 3rd, 2015, from a sale announcement made by the creator, and the malware is still active to this day.

General description of LokiBot

Initially created and sold by a hacker known as "lokistov" or "Carter," the first versions of LokiBot spyware used to cost up to $400. However, almost identical malware appeared on hacker forums soon after, available for as little as $80 from several sellers. As it is thought, "lokistov" himself was hacked, and the virus's source code was leaked, allowing others to use its techniques and sell remarkably similar malware.

Curiously, a researcher subsequently found out that the first version of the virus got patched by someone without accessing the source code, which gave the hacker community the ability to set a series of individual domains used to receive the retrieved data.

Even though several versions of the virus exist today, after the analysis, it was found that all of them are actually modifications of the original malware. Interestingly, the server to which LokiBot stealer sends data is unique for every particular malware sample.

In the latest versions of LokiBot, a third stage is added to the process of compromising systems, besides more encryption, a technique to escape detection. Each layer of the trojan is encrypted to attempt to hide the eventual source of code.

The malware uses the known technique of blurring images in documents to force users to enable macros. This trick infects machines quite successfully.

LokiBot malware analysis

A video displaying the simulation of the contamination process created by the ANY.RUN interactive malware hunting service provides the perfect opportunity for malware analysis to see how the contamination process unfolds on an infected machine. As shown in the simulation, LokiBot trojan needs email attachments, such as a Microsoft Office file or an archive file to be opened to enter an active phase.

process graph of lokibot stealer execution Figure 1: Process graph generated by the ANY.RUN malware hunting service

During the analysis, we found out that the malware life cycle can be broken down into the following stages:

  • Contamination. The victim downloads a malicious archive or a Microsoft Office file which eventually downloads the malware;
  • Being packed initially, the keylogger unpacks itself and begins the execution of the main payload;
  • The virus creates unique loop-functions for each application that it is targeting and saves retrieved data into a buffer;
  • Then, a registry key is modified, and the trojan is explicitly copied into a folder with a specific name unique name under the %APPDATA% folder. This allows the virus to establish persistence. MachineGuid MD5 is used for the name generation, and the name can also be used as a Mutex as well as bot-id. As the last action of this step, the virus generates a registry key that points to the file it copied before to the specific folder inside the %APPDATA% folder;
  • Then, depending on if the current user is privileged or not, the virus sets persistence either under HKEY_LOCAL_MACHINE or KEY_CURRENT_USER;
  • Next, general system information is sent to the C&C server;
  • For persistence, the keylogger then applies the triple-DES encryption technique to the URL and the registry key;
  • After this, the virus starts waiting for commands from C&C, creating a new thread to detect the C&C response.

How to avoid infection by LokiBot virus?

Since LokiBot spyware requires macros to be activated to infect the system, attackers will do everything in their power to make the victim enable them. Thus keeping macros turned off is the best bet to stay protected from the trojan. Notably, extra caution should be exhibited when a document downloaded from a suspicious source or an unknown email address prompts to enable macros.

Also, having antivirus software from trusted developers and keeping it updated is an excellent way to decrease the probability of becoming the malware's victim and protecting credentials. Another good common practice is to be highly mindful when opening attachments or clicking links in emails from unidentified sources as it's a popular method of malware spreading, including FormBook and Dridex.

Distribution of LokiBot

LokiBot stealer is distributed mostly via mail-spam campaigns, prompting the user to download a malicious file that is attached. Remarkably, the three most commonly used types of files are Microsoft Office documents configured to begin the download and installation processes of the malware, archive files containing a Loki-Bot executable or ISO files, and a Loki-Bot executable.

LokiBot execution process

Interactive sandbox simulation conducted on the ANY.RUN malware hunting service allows us to take a closer look at how the execution process of LokiBot unfolds in a case when a contaminated Microsoft Office file is the infection source.

  • The simulation starts with opening a Microsoft Office file. Immediately, WINWORD.EXE is executed with enable macros.
  • Then, through the exploitation of the CVE-2017-11882 vulnerability, Microsoft Office Equation Editor proceeds to download a malicious executable file;
  • Finally, a malicious executable file runs itself and then proceeds to steal the personal data and connect to the C&C server.

process tree of a lokibot stealer execution Figure 2: Illustrates the execution processes of LokiBot as shown by ANY.RUN simulation

a text report of a lokibot analysis Figure 3: A text report created by ANY.RUN

The virus generates multiple artifacts during its execution process. Particularly, four types of files can be simultaneously stored in the secret %APPDATA% directory at any point in time. Those files can have ".exe," ".lck," ".hdb" or ".kdb." extensions, and each file type is used for a specific purpose:

  • .exe files contain an executable copy of the trojan that triggers when a user logs into an account,
  • .lck files are generated to prevent resource conflicts when either Windows Credentials or Keylogging are decrypted,
  • .hdb files are used to store the hashes of all data samples already transmitted to the C&C server
  • .kdb files are in turn used to hold information about the data that is yet to be sent to the server

Based on the analysis, the keylogger uses the following algorithm to name the files:

  1. First, LokiBot takes the value of MachineGuid from the registry branch HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Cryptography . In the case of our simulation, it was set to dc5131b5-5fbc-4f85-b1ed-28d4392080ca.

lokibot mutex creation GUID registry

  1. Then, the virus uses the MD5 algorithm to calculate the hash sum of the MachineGuid, which in our case ended up being c83ba0aa282a966263dda560052b3caf.

lokibot mutex creation md5

  1. Finally, characters from the 8th to the 13th of the resulting hash amount are used as the subdirectory's name, and the characters from the 13th to the 18th are used as the name of the files.

lokibot mutex creation

LokiBot communication with C&C

To communicate with the C&C server, the patched version of the virus, which is also the most widely spread strain, sends a "ckav.ru" string. Interestingly, the sent data is also is a substring of "fuckav.ru."

How to detect LokiBot malware using ANY.RUN?

Among other things, you can detect whether it is LokiBot in front of you or not by looking inside sending packets - there's always text "ckav.ru" inside them. Just click on the sent packet in the "HTTP REQUESTS" tab and take a look inside a packet.

lokibot network stream Figure 4: Lokibot network stream

Conclusion

Lastly, since the first version of the malware was leaked and cloned, eventually becoming available for a significantly lower price than the original, LokiBot spyware became a widely spread malware that continues to appear in several mail-spam campaigns. In fact, the virus has become so popular that its set-up explanation videos on stealing credentials are publically available on YouTube.

Fortunately, modern malware hunting tools like ANY.RUN provides the ability to examine the malware behavior in detail and establish solid protection against the hazard.

IOCs

IP addresses
172.67.179.121
31.170.160.61
162.241.3.30
172.67.214.235
50.31.174.86
103.199.16.121
72.52.238.62
185.14.29.199
104.18.41.63
148.66.136.188
111.90.156.65
172.67.150.86
185.180.196.9
192.64.119.205
172.67.196.35
5.253.61.167
104.18.39.225
104.18.40.57
192.185.119.187
45.252.249.32
Hashes
47b9aff8539db6b73439bc82d9b554fec84cc69bdfc0e509a63fb146e2fdaf46
78fbe00d497dc9ee0fa4dcbd83d5b04928bb6c952adedf721e9c577548ce8c12
25a16ecd58f1e4d4519cee4cd646de26bec0a672e3c7fd1c344835451ff5e9b5
4339ebf2887db03e86b83f7108b649e724fd71795ab6dc47a4eb268a78d6809c
d21c653f7179ec7a9cc3444b95de606d4ec76538c3023748cf265f0468f741c6
8f2a0dc81907a6d52ac8497d7ca4dcdcdb6ec549a3c179d51941a76075cad38f
013e2668c87f03a7641fc215bfaf4f7cb7d547d1d74ce62afb423adb53e3b209
f27599a2a355429f43af0ebe1661466b5914e2be24e4586e5059358360a48ec3
f7ad4b09afb301ce46df695b22114331a57d52e6d4163ff74787bf68ccf44c78
6f79b33f5d6b7239c252e3bc2ca6c7287af8c59dea3dc225c38b70b0d741a36f
ef84bc83d27782f0513055718f2a72752dda55d22224516a3bbe29aa25542050
e2129c0979e137c9a442721f9198c70fdcbdd0356df14a3d4e35c994614d03b0
78e5d7d0502977044109013b3946c9e65c4b96771b2e23c159db32499f08781b
93b0d7f44fe52ecc63fc27d48da7876ee50872e2471591c0304ca21d0ccc68d6
5d99ab24811624ef3c5f5d8c9b71009ebe33acfbb235cb58400c2a4b6e0c30bf
68a692e6b53e883b1dfb03c2fe6ad816b9b53945b7293e82e7e04121699f7559
e1b43a4ba3e06006328305893b4af467d63aeac6d0c9e43057a20b883e67c89b
f96f2dc00edf430af1b60c783867a75415e55965fbabea46318ebbef910d9a76
57cdb4d1bc88747a4552289f269a58948d096853d812b2224feab1751d974c30
8cdaa8c78832fc5e53ab2cd5eea5f5ac458a7599c4ed67d985dd3876cfdf8777
Domains
booking.msg.bluhotels.com
booking.msg.bluhotels.com
alfa-sentavra.at
adonis-medicine.at
predictindia.co
eatcells.com
isns.net
todspm3.duckdns.org
ww38.messagemates.com
biggames.club
beholder.xyz
majul.com
forfor.site
www.admotion.com
parkingcrew.net
www.lieebherr.com
www.downloadnetcat.com
brighteducationc.com
valenciahillscondo.com
poweringinfluence.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control the PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server.
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Cobalt Strike screenshot
Cobalt Strike
cobaltstrike
Cobalt Strike is a legitimate penetration software toolkit developed by Forta. But its cracked versions are widely adopted by bad actors, who use it as a C2 system of choice for targeted attacks.
Read More

Our website uses cookies. By visiting the pages of the site, you agree to our Privacy Policy