✕
Request a Demo
Rewterz
Rewterz Threat Advisory – CVE-2020-7760 – Node.js codemirror module denial of service
November 3, 2020
Rewterz
Rewterz Threat Advisory – Adobe Acrobat and Reader Multiple Vulnerabilities
November 4, 2020

Rewterz Threat Alert – LokiBot Malware – IOCs

Severity

High

Analysis Summary

LokiBot is trojan-type malware designed to infiltrate systems and collect a wide range of information. Lokibot targets Android and Windows operating systems. It is distributed via spam emails, various private messages (SMS, Skype, etc.), and malicious websites. It is designed to target users. LokiBot gathers saved logins/passwords (mostly in web browsers) and continually tracks users’ activity (for instance, recording keystrokes). Recorded information is immediately saved on a remote server controlled by LokiBot’s developers.

Impact

  • Credential theft 
  • Information theft 
  • Exposure of sensitive data

Indicators of Compromise

URL

  • http[:]//103[.]125[.]191[.]229/office360/regasm[.]exe
  • http[:]//magicview[.]ga/ibiki/gate[.]php
  • http[:]//stdygreenkegheedahatakankeadeshnaastfaw[.]ydns[.]eu/office360/regasm[.]exe
  • http[:]//magicview[.]ga/kung/gate[.]php
  • http[:]//stdyunitedfrkesokoriorimistreetsmsttyr[.]ydns[.]eu/chnsfrnd1/vbc[.]exe
  • http[:]//magicview[.]ga/rojas/gate[.]php
  • http[:]//greenthdykegheedahatakankeadeshnaathfgh[.]ydns[.]eu/office360/regasm[.]exe
  • http[:]//209[.]141[.]35[.]239/33/MTO-0217[.]jpg
  • http[:]//209[.]141[.]35[.]239/33/RF-10665[.]jpg

Remediation

  • Block all threat indicators at your respective controls. 
  • Search for IOCs in your environment.