Rewterz Threat Alert – LokiBot Malware – Active IOCs

August 20, 2021

Severity

Medium

Analysis Summary

LokiBot is a commodity malware sold on underground sites which are designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets. LokiBot is trojan-type malware designed to infiltrate systems and collect a wide range of information. Lokibot targets Android and Windows operating systems. It is distributed via spam emails, various private messages (SMS, Skype, etc.), and malicious websites. It is also used for tracking users’ activity (for instance, recording keystrokes).

Impact

Information Theft
Exposure of Sensitive Data
Credential Theft

Indicators of Compromise

MD5

dc5a288495261c9516ce546c1d5dc2fe
2d7c454c7dc1b5a3222cb313e46cb031
dc5a288495261c9516ce546c1d5dc2fe
977a54b4b75bbf17c434af699ab238d2
228ae9f3b0b8e8b6591211a1eb72dd3e
6713e66d74207f42abf5e27ab348b5c7
a0d7c028bb71809eadcb13bb04851c16
de4864fb07cf56acc544dc56462c2243
b223c115e88dbce06f8b577384936810
1a867bad9a3ca438c6ab200a25f854c0
32974780398cd354379048268acba570
fc9bb08703623f16b3b6fd654ab14b4a

SHA-256

602787461573a5edc7b3f3e0b16ed1198ddd172f0c61cb1e76fd01c6c18cd375
c622aba165328306741f8878ecdaa1aadd9d1f0f3718c7211ea6bda2aba21dcd
602787461573a5edc7b3f3e0b16ed1198ddd172f0c61cb1e76fd01c6c18cd375
f6269231c3d91cd11c30077a051499f1240d239eeb11d883910e986adf462e24
2b8ac768796de30803bc5bb6f116d39d0ee7843715b66b875d0942029d14e172
6ad1a9114fabea8c23151bcb789a9867cb2345e7b65187e5443e6f76f20c7037
e394ca16835c98c38eef2c613122ea8304645155327bd920265bd796a0ebb071
f4a13349af9fadfa63e888b2d7e03151aac194eb9190edfe0aedd272273f8b56
c03f1704539a0c87e25b23dbd303f0f5fe0b0db74dd699e73d3b820d1dc3e96c
852db9a27bdd0ec63f248b85cb371f95c8ad8018e01c93f2257b6738e7d8083f
4c1ff62f3b954a76ff2107ec2d4ec6cb3f2d05cee012f7137d8fa9f51e1fb2c7
9bdcb8eed0ddc7b700e3ac1ded641d2f5f703ea3cdfedc5eaad228f01cbb94d6

SHA1

e80c7fb1427b4f0178301f12a3c7871e168c43d2
ac529d8d04a2e279dfe876b14e5de255b91da23e
e80c7fb1427b4f0178301f12a3c7871e168c43d2
159d763b4e86cf37bc6108c8936e1b87133f73a2
210d71ccc2b1539b65fb07a4834fe04d777ad88d
b5913c9562d2cb75bab2b49aaca6166a33bd5c6a
15ef855c5dfc1a940a9b3c713df104f4a08bc6f1
520a11afb0bf7fc8eafa454d30c20984035b9d3d
b5f523ed9550308703ea2c23c971dcf8af48989f
61e7298d178ed1478621838563758db9d04db32f
8aa37552e4a4771e337d2cfeb9b0c8ecaa0c48ed
6031a2a5e8be0d2004f4422a6bf88ad11909c75b

URL

http[:]//65[.]21[.]223[.]84/~t/i[.]html/m9vo3uzZGXz0z
http[:]//apponline354[.]ir/ejiofor/Panel/fre[.]php
http[:]//brokenislegion[.]tk/BN1/fre[.]php
http[:]//185[.]118[.]164[.]109/MaRYmoTheROfJESUS/fre[.]php
http[:]//www[.]rnofinancial[.]com[.]au/wp03/five/fre[.]php
https[:]//www[.]rnofinancial[.]com[.]au/wp02/five/PvqDq929BSx_A_D_M1n_a[.]php?hpyU=QYusoTbxVem/fre[.]php
http[:]//www[.]rnofinancial[.]com[.]au/wp02/five/PvqDq929BSx_A_D_M1n_a[.]php?hpyU=QYusoTbxVem/fre[.]php
http[:]//103[.]167[.]90[.]246/hdfc/vbc[.]exe

Remediation

Search for IOCs in your environment.
Block all threat indicators at their respective controls.