{"id":1332,"date":"2024-09-22T19:50:41","date_gmt":"2024-09-22T19:50:41","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=1332"},"modified":"2025-07-29T07:31:10","modified_gmt":"2025-07-29T07:31:10","slug":"analysis-of-lokibot-campaign","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/analysis-of-lokibot-campaign\/","title":{"rendered":"Analysis of Lokibot Campaign"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

LokiBot, alternatively referred to as Loki or Lokibot, is a form of malicious software (malware) categorized as a banking trojan and information stealer. It specifically targets Windows-based systems and is primarily utilized to illicitly obtain sensitive information, with a particular focus on capturing banking credentials, login details, and other personal data.<\/p>\n\n\n\n

Programming Language:<\/strong> Lokibot is primarily written in C++. The use of C++ allows the malware to be efficient, and it is a common language for developing Windows-based malware.<\/p>\n\n\n\n

Lokibot Evolution:<\/strong> Lokibot has undergone several iterations and updates over the years. Like many malware strains, it has adapted to changes in cybersecurity defenses, evolving its techniques to avoid detection and improve its capabilities.<\/p>\n\n\n\n

Distribution of Lokibot:<\/strong> The malware is often distributed through phishing campaigns.<\/p>\n\n\n\n

Example: Guloader distributing the following malware variants namely,<\/p>\n\n\n\n

Nanocore RAT<\/p>\n\n\n\n

Remcos RAT<\/p>\n\n\n\n

Agent Tesla<\/p>\n\n\n\n

Lokibot<\/p>\n\n\n\n

xLoader<\/p>\n\n\n\n

Netwire<\/p>\n\n\n\n

Initially GuLoader samples were able to get past detection by traditional antivirus software, but advanced security solutions eventually proved capable of detecting this malware.  However, the GuLoader developers proceeded to improve their product in parallel with the continual development of antivirus software by cyber security OEMs. Cybercriminals have been known to employ various social engineering tactics, such as malicious emails with attachments or links with or without evasion shellcode, to trick users to click on the links and infect their systems.<\/p>\n\n\n\n

Infection Chain:<\/strong><\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Target – Windows Platform<\/p>\n\n\n\n

Infection Vector \u2013 Malicious spam campaigns and\/or phishing emails.<\/p>\n\n\n\n

Key Characteristics & Functionality of Lokibot<\/strong><\/h2>\n\n\n\n

Information Theft: Lokibot is primarily designed to steal sensitive information such as login credentials, usernames, passwords, and other financial data. It often targets online banking and other financial services.<\/p>\n\n\n\n

Keylogging: One of Lokibot’s main functionalities is keylogging, which involves recording keystrokes made by the user. This helps the malware capture login credentials and other sensitive information entered by the user.<\/p>\n\n\n\n

Data Exfiltration: Once Lokibot collects the targeted information, it can send this data to a remote server controlled by the attackers. This allows cybercriminals to access and use the stolen information for fraudulent activities.<\/p>\n\n\n\n

Persistence: Lokibot is known for its ability to maintain persistence on infected systems, ensuring that it remains active and continues to steal information over an extended period.<\/p>\n\n\n\n

Evolution: Like many malware strains, Lokibot undergoes changes and updates to avoid detection by security software. It may be distributed through various means, such as phishing emails, malicious websites, or infected attachments. Command and Control (C2) Servers: Lokibot communicates with remote servers controlled by cybercriminals to receive commands, updates, and to transmit stolen data.<\/p>\n\n\n\n

Sample Information:<\/strong><\/h3>\n\n\n\n

Threat Name: LokiBot | Classification: Downloader<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Technical Analysis of LokiBot Malware:<\/strong><\/h2>\n\n\n\n

This campaign typically begins with the distribution of spam emails. These emails often contain content in various languages, which can confuse users and prompt them to enable the macro content in the attached document in order to view it.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Phishing Email Template<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Macro enabled content<\/p>\n\n\n\n

VBA Macro_Modules:<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

VBA Specialfolders:<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Char Encoding Technique:<\/strong><\/p>\n\n\n\n

Character encoding is a method in computing that translates characters and symbols into binary data, assigning a specific binary code to each character for storage and transmission.<\/p>\n\n\n\n

ASCII, UTF-8, and UTF-16 are well-known character encoding schemes, each with its capacity to represent diverse character sets, including various languages and special symbols. Character encoding plays a crucial role in text processing, communication, and ensuring cross-system and cross-language compatibility.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Char Encoding Technique<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Obfuscated URL<\/p>\n\n\n\n

Malware authors leverage VBA special folders in Excel for persistent execution, evading security detection, gaining trust, exploiting user interactions, and facilitating the spread of malicious macros.<\/p>\n\n\n\n

Obtained Obfuscated URL:<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Indicator of Compromise:<\/strong><\/p>\n\n\n\n

Indicators of Compromise (IoCs) are like clues in cybersecurity. They help expert\u2019s spot signs of a possible security problem, allowing them to investigate and fix issues related to cyber threats.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Complete URL > Payload EXE downloader<\/p>\n\n\n\n

The submitted URL domain IP has been blacklisted, indicating that it is a harmful website that hosts malicious payload files.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Main Domain > IP Blacklisted<\/p>\n\n\n\n

MITRE ATT&CK Tactics & Techniques for Lokibot VBA variant:<\/strong><\/p>\n\n\n\n

ID<\/td>Tactic<\/td>Technique<\/td><\/tr>
TA0001<\/td>Initial Access<\/td>Spam Email Phishing Attachment<\/td><\/tr>
TA0002<\/td>Execution<\/td>Windows Scripting – XLS VBA Macro Codes<\/td><\/tr>
TA0003<\/td>Persistence<\/td>Modify Registry Log-on Initialization Scripts<\/td><\/tr>
TA0004<\/td>Privilege Escalation<\/td>Scheduled Task \/ Job<\/td><\/tr>
TA0005<\/td>Defense Evasion<\/td>Virtualization and Sandbox Evasion Technique Obfuscated file or Information<\/td><\/tr>
TA0006<\/td>Credential Access<\/td>OS Credential Dumping LSASS Memory Input Capture<\/td><\/tr>
TA0007   TA0008<\/td>Discovery   Lateral Movement<\/td>System Software Discovery Process Discovery File and Directory Discovery Query Registry     Remote file copy<\/td><\/tr>
TA0009<\/td>Collection<\/td>Credential API Hooking Archive Collected   Data   Data from Local System<\/td><\/tr>
TA0011<\/td>C&C Server  <\/td>Encrypted Channels Web Protocols – Standard Application Layer Protocol  Ingress Tool Transfer<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"

LokiBot, alternatively referred to as Loki or Lokibot, is a form of malicious software (malware) categorized as a banking trojan and information stealer. It specifically targets Windows-based systems and is primarily utilized to illicitly obtain sensitive information, with a particular focus on capturing banking credentials, login details, and other personal data. Programming Language: Lokibot is […]<\/p>\n","protected":false},"author":1,"featured_media":1336,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1332","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=1332"}],"version-history":[{"count":3,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1332\/revisions"}],"predecessor-version":[{"id":4427,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1332\/revisions\/4427"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/1336"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=1332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=1332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=1332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}