BOOK AN APPOINTMENT WITH AN IT SPECIALIST TODAY

22 Sep 2020

AA20-266A: LokiBot Malware

Original release date: September 22, 2020

Summary

This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise frameworks for all referenced threat actor techniques.

This product was written by the Cybersecurity and Infrastructure Security Agency (CISA) with contributions by the Multi-State Information Sharing & Analysis Center (MS-ISAC).

CISA has observed a notable increase in the use of LokiBot malware by malicious cyber actors since July 2020. Throughout this period, CISA’s EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks, has detected persistent malicious LokiBot activity. LokiBot uses a credential- and information-stealing malware, often sent as a malicious attachment and known for being simple, yet effective, making it an attractive tool for a broad range of cyber actors across a wide variety of data compromise use cases.

Technical Details

LokiBot—also known as Lokibot, Loki PWS, and Loki-bot—employs Trojan malware to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials.

  • The malware steals credentials through the use of a keylogger to monitor browser and desktop activity (Credentials from Password Stores [T1555]).
    • (Credentials from Password Stores: Credentials from Web Browsers [T1555.003])
    • (Input Capture: Keylogging [T1056.001])
  • LokiBot can also create a backdoor into infected systems to allow an attacker to install additional payloads (Event Triggered Execution: Accessibility Features [T1546.008]).
  • Malicious cyber actors typically use LokiBot to target Windows and Android operating systems and distribute the malware via email, malicious websites, text, and other private messages (User Execution: Malicious File [T1204.002]). See figure 1 for enterprise techniques used by LokiBot.

Figure 1: MITRE ATT&CK enterprise techniques used by LokiBot

Since LokiBot was first reported in 2015, cyber actors have used it across a range of targeted applications, including the following.

  • February 2020: Trend Micro identified cyber actors using LokiBot to impersonate a launcher for Fortnite—a popular video game.[1]
  • August 2019: FortiGuard SE researchers discovered a malspam campaign distributing LokiBot information-stealing payloads in spearphishing attack on a U.S. manufacturing company.[2]
  • August 2019: Trend Micro researchers reported LokiBot malware source code being hidden in image files spread as attachments in phishing emails.[3]
  • June 2019: Netskope uncovered LokiBot being distributed in a malspam campaign using ISO image file attachments.[4]
  • April 2019: Netskope uncovered a phishing campaign using malicious email attachments with LokiBot malware to create backdoors onto infected Windows systems and steal sensitive information.[5]
  • February 2018: Trend Micro discovered CVE-2017-11882 being exploited in an attack using Windows Installer service to deliver LokiBot malware.[6]
  • October 2017: SfyLabs identified cyber actors using LokiBot as an Android banking trojan that turns into ransomware.[7]
  • May 2017: Fortinet reported malicious actors using a PDF file to spread a new LokiBot variant capable of stealing credentials from more than 100 different software tools.[8]
  • March 2017: Check Point discovered LokiBot malware found pre-installed on Android devices.[9]
  • December 2016: Dr.Web researchers identified a new LokiBot variant targeting Android core libraries.[10]
  • February 2016: Researchers discovered the LokiBot Android Trojan infecting the core Android operating system processes.[11]

MITRE ATT&CK Techniques

According to MITRE, LokiBot uses the ATT&CK techniques listed in table 1.

Table 1: LokiBot ATT&CK techniques

Technique

Use

System Network Configuration Discovery [T1016]

LokiBot has the ability to discover the domain name of the infected host.

Obfuscated Files or Information [T1027]

LokiBot has obfuscated strings with base64 encoding.

Obfuscated Files or Information: Software Packing [T1027.002]

LokiBot has used several packing methods for obfuscation.

System Owner/User Discovery [T1033]

LokiBot has the ability to discover the username on the infected host.

Exfiltration Over C2 Channel [T1041]

LokiBot has the ability to initiate contact with command and control to exfiltrate stolen data.

Process Injection: Process Hollowing [T1055.012]

LokiBot has used process hollowing to inject into legitimate Windows process vbc.exe.

Input Capture: Keylogging [T1056.001]

LokiBot has the ability to capture input on the compromised host via keylogging.

Application Layer Protocol: Web Protocols [T1071.001]

LokiBot has used Hypertext Transfer Protocol for command and control.

System Information Discovery [T1082]

LokiBot has the ability to discover the computer name and Windows product name/version.

User Execution: Malicious File [T1204.002]

LokiBot has been executed through malicious documents contained in spearphishing emails.

Credentials from Password Stores [T1555]

LokiBot has stolen credentials from multiple applications and data sources including Windows operating system credentials, email clients, File Transfer Protocol, and Secure File Transfer Protocol clients.

Credentials from Password Stores: Credentials from Web Browsers [T1555.003]

LokiBot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and Chromium and Mozilla Firefox-based web browsers.

Hide Artifacts: Hidden Files and Directories [T1564.001]

LokiBot has the ability to copy itself to a hidden file and directory.

Detection

Signatures

CISA developed the following Snort signature for use in detecting network activity associated with LokiBot activity.

alert tcp any any -> any $HTTP_PORTS (msg:”Lokibot:HTTP URI POST contains ‘/*/fre.php’ post-infection”; flow:established,to_server; flowbits:isnotset,.tagged; content:”/fre.php”; http_uri; fast_pattern:only; urilen:<50,norm; content:”POST”; nocase; http_method; pcre:”//(?:alien|lokyd|donep|jemp|lokey|new2|loki|Charles|sev7n|dbwork|scroll/NW|wrk|job|fived?|donemy|animationdkc|love|Masky|vd|lifetn|Ben)/fre.php$/iU”; flowbits:set,.tagged;classtype:http-uri; metadata:service http; metadata:pattern HTTP-P001,)

Mitigations

CISA and MS-ISAC recommend that federal, state, local, tribal, territorial government, private sector users, and network administrators consider applying the following best practices to strengthen the security posture of their organization’s systems. System owners and administrators should review any configuration changes prior to implementation to avoid unwanted impacts.

  • Maintain up-to-date antivirus signatures and engines. See Protecting Against Malicious Code.
  • Keep operating system patches up to date. See Understanding Patches and Software Updates.
  • Disable file and printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
  • Enforce multi-factor authentication. See Supplementing Passwords for more information.
  • Restrict users’ ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators’ group unless required.
  • Enforce a strong password policy. See Choosing and Protecting Passwords.
  • Exercise caution when opening email attachments, even if the attachment is expected and the sender appears to be known. See Using Caution with Email Attachments.
  • Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
  • Disable unnecessary services on agency workstations and servers.
  • Scan for and remove suspicious email attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
  • Monitor users’ web browsing habits; restrict access to sites with unfavorable content.
  • Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs).
  • Scan all software downloaded from the internet prior to executing.
  • Maintain situational awareness of the latest threats and implement appropriate access control lists.
  • Visit the MITRE ATT&CK Techniques pages (linked in table 1 above) for additional mitigation and detection strategies.

For additional information on malware incident prevention and handling, see the National Institute of Standards and Technology Special Publication 800-83, Guide to Malware Incident Prevention and Handling for Desktops and Laptops.

Resources

Center for Internet Security Security Event Primer – Malware: https://www.cisecurity.org/white-papers/security-event-primer-malware/
MITRE ATT&CK – LokiBot: https://attack.mitre.org/software/S0447/
MITRE ATT&CK for Enterprise: https://attack.mitre.org/matrices/enterprise/

References

Revisions

  • September 22, 2020: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

More Like This

What Are the Key Differences Between IT Services and Consulting?

What Are the Key Differences Between IT Services and Consulting? When business leaders create annual budgets, IT typically ranks among the top investments. More than $4 trillion was spent globally in 2019, and the average company funneled 8.2 percent of its total revenue into IT. The primary focus for too many companies was IT services, …

What Are the Key Differences Between IT Services and Consulting? Read More »

Read More

AA21-008A: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments

Original release date: January 8, 2021 Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. This Alert is a companion alert to AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. AA20-352A …

AA21-008A: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments Read More »

Read More

Microsoft Makes Anti-Spam Changes

Microsoft Makes Anti-Spam Changes The year 2020 is not the only thing that is coming to an end. Microsoft is slowly rolling out changes meant to deter spam. This is causing some features to come to an end and changing the way a few Microsoft products, most notably email, is used. As a business owner, …

Microsoft Makes Anti-Spam Changes Read More »

Read More

AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations

Original release date: December 17, 2020<br/><h3>Summary</h3><p class=”tip-intro” style=”font-size: 15px;”><em>This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK®) version 8 framework. See the <a href=”https://attack.mitre.org/versions/v8/”>ATT&amp;CK for Enterprise version 8</a> for all referenced threat actor tactics and techniques.</em></p> <p>The Cybersecurity and Infrastructure Security Agency (CISA) is aware of compromises of U.S. government agencies, critical …

AA20-352A: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations Read More »

Read More

Top 15 Microsoft Teams Tips and Tricks

Top 15 Microsoft Teams Tips and Tricks Microsoft Teams is one of the most popular and influential digital team-building solutions available for startups and business teams of any size. Using Microsoft Teams as your company’s preferred collaboration tool provides access to myriad features, from private messaging and group chats to file and document-sharing. With a …

Top 15 Microsoft Teams Tips and Tricks Read More »

Read More

9 Meeting Tips for Using Microsoft Teams

9 Meeting Tips for Using Microsoft Teams Microsoft Teams is a simple, yet effective tool for hosting meetings. It has both audio and video capabilities as well as a chat feature. It can handle conference calls and one on one meetings, with members of your organization as well as guests. Plus, it has a convenient …

9 Meeting Tips for Using Microsoft Teams Read More »

Read More