Rewterz Threat Alert – LokiBot Gains New Persistence Mechanism, Uses Steganography to Hide Its Tracks

Severity

High

Analysis summary

First advertised as an information stealer and keylogger when it first appeared in underground forums, LokiBot has added various capabilities over the years. Recent activity has seen the malware family abusing Windows Installer for its installation and introducing a new delivery method that involves spam mails containing malicious ISO file attachments. an email with an attachment— allegedly from a confectionery company based in India. An alert from the virtual analyzer of the company’s , along with the suspicious nature of the email.

The attachment itself, New Order July .DOC, (detected as Trojan.W97M.DLOADER.PUQ) had two embedded objects:

• a Microsoft Excel 97-2003 Worksheet
• a package labeled ‘package.json’

Upon execution, the document will immediately show a Microsoft Excel worksheet, which in turn would execute the VBS macro code embedded in the worksheet.

Impact

Information theft

Indicators of Compromise

Filename

New Order July .DOC

Malware Hash (MD5/SHA1/SH256)

• 7812e7564a1e2480412b228daf4c53e9f5291bbdb06120ec778cf4ed0a6654d7
• fd908abce7885430fb344aedb21cee0aa73f2bd7b82ab118974674afdfe45fc2as
• 84700ef750fa74f0837521037d4d5318274a5542b57e5ee92e27a168dd8938c4
• 0a6e59e1d01521e4b0eb19faafe221737120183847a0fd6bc5a43f6fbc05d81f

Remediation

• Block the threat indicators at their respective controls.
• Always be suspicious of unsolicited email.
• Never click/ download any attachments sent from unrecognized senders.