Severity
High
Analysis summary
First advertised as an information stealer and keylogger when it first appeared in underground forums, LokiBot has added various capabilities over the years. Recent activity has seen the malware family abusing Windows Installer for its installation and introducing a new delivery method that involves spam mails containing malicious ISO file attachments. an email with an attachment— allegedly from a confectionery company based in India. An alert from the virtual analyzer of the company’s , along with the suspicious nature of the email.
The attachment itself, New Order July .DOC, (detected as Trojan.W97M.DLOADER.PUQ) had two embedded objects:
- a Microsoft Excel 97-2003 Worksheet
- a package labeled ‘package.json’
Upon execution, the document will immediately show a Microsoft Excel worksheet, which in turn would execute the VBS macro code embedded in the worksheet.
Impact
Information theft
Indicators of Compromise
Filename
New Order July .DOC
Malware Hash (MD5/SHA1/SH256)
- 7812e7564a1e2480412b228daf4c53e9f5291bbdb06120ec778cf4ed0a6654d7
- fd908abce7885430fb344aedb21cee0aa73f2bd7b82ab118974674afdfe45fc2as
- 84700ef750fa74f0837521037d4d5318274a5542b57e5ee92e27a168dd8938c4
- 0a6e59e1d01521e4b0eb19faafe221737120183847a0fd6bc5a43f6fbc05d81f
Remediation
- Block the threat indicators at their respective controls.
- Always be suspicious of unsolicited email.
- Never click/ download any attachments sent from unrecognized senders.