First advertised as an information stealer and keylogger when it first appeared in underground forums, LokiBot has added various capabilities over the years. Recent activity has seen the malware family abusing Windows Installer for its installation and introducing a new delivery method that involves spam mails containing malicious ISO file attachments. an email with an attachment— allegedly from a confectionery company based in India. An alert from the virtual analyzer of the company’s , along with the suspicious nature of the email.
The attachment itself, New Order July .DOC, (detected as Trojan.W97M.DLOADER.PUQ) had two embedded objects:
Upon execution, the document will immediately show a Microsoft Excel worksheet, which in turn would execute the VBS macro code embedded in the worksheet.
New Order July .DOC
Malware Hash (MD5/SHA1/SH256)