{"id":2664,"date":"2021-06-21T11:03:42","date_gmt":"2021-06-21T09:03:42","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2664"},"modified":"2026-06-08T23:12:05","modified_gmt":"2026-06-08T23:12:05","slug":"lokibot-campaign-update-june-2021","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/lokibot-campaign-update-june-2021\/","title":{"rendered":"LokiBot campaign \u2014 update of 21 June 2021"},"content":{"rendered":"\n

In recent weeks, a phishing<\/strong> campaign targeting Italian user email addresses has been detected.
Emails are sent from non-existent Italian commercial entities using the address info@it0b[.]xys<\/strong> with subject “INVOICE SUBMISSION DOC_768 COMPANY NAME<\/strong>“.<\/p>\n

The email body is written in Italian and contains a ZIP file attachment with the same name as the subject line.<\/p>\n\n\n\n

\"\"
From: Phishing email “INVOICE SUBMISSION DOC_” delivers LokiBot (AL03\/210618\/CSIRT-ITA) – Italian CSIRT<\/a> <\/figcaption><\/figure>\n\n\n\n

Within the ZIP file is an ISO file containing an EXE file identified as LokiBot<\/strong>.<\/p>\n\n\n\n

The malware is an infostealer and RAT<\/strong> capable of harvesting user credentials through a keylogger<\/strong> module; it can also establish a backdoor<\/strong> to permit the attacker to deploy additional malicious payloads<\/em>.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Detected samples establish a connection to IP address 63.141.228[.]141<\/strong>. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In other cases, a DNS query is executed for the domain manvim[.]co<\/strong>, resolved to IP address 35.193.27[.]228<\/strong> (registered 2021-05-04). Analysis of such infrastructure patterns through Cyber Threat Intelligence<\/a> sources reveals consistent command-and-control behaviour across multiple LokiBot variants.<\/p>\n\n\n\n

IOC<\/h3>\n\n\n\n

ZIP Attachment:<\/strong><\/p>\n\n\n\n

  • MD5 7dcd5b2527962fffbfb47aaafd8017cf<\/li>
  • SHA-1 7acc748b915a7c2e0dd6f89bc35653477d3f8ea5<\/li>
  • SHA-256 7804087ee95b9c0f488db921f24e4aa69df6ee10189d1399fe7dfb8383b1c6f5<\/li><\/ul>\n\n\n\n

    ISO Image: <\/strong><\/p>\n\n\n\n

    • MD5 c35c0bc696ba1a1f1a843ce6d4a63818<\/li>
    • SHA-1 8cf0ff7c7f6635d6fe116b30ddd78aca14a35851<\/li>
    • SHA-256 12eed57e3431669c9b53a3ac1a556617df0894b078cd0227cfebc15e9e67df8f<\/li><\/ul>\n\n\n\n

      Executable: <\/strong><\/p>\n\n\n\n

      • MD5 e54937c7d7e2cac41541e6a416c9cb90<\/li>
      • SHA-1 1c43eae1d54d7d242ccd223b6b23a6a4fa21a8a3<\/li>
      • SHA-256 0c4efefcd2850c9764e65fb0f5a084573dfb65c7103b4513781c02e06e21c83a<\/li><\/ul>\n\n\n\n

        Additional Executables:<\/strong><\/p>\n\n\n\n

        • SHA-256 3e56d9df1d14f5758330600d1d2fd098a173842fae0447bdf8e6d97a4d2c7162 <\/li>
        • SHA-256 254de372db20f35fb440552d22068d975bfb6fafd7902d2826318033b01428a8<\/li>
        • SHA-256 ced5590738ce4d32f26c917992c21656c60a5ed3a2fffb02beb5b09b1d5d626f<\/li>
        • SHA-256 1eb22488631a731f6fc27ad209f386b8b0aa6181016badff86ee36bc2e42a256<\/li>
        • SHA-256 c252af943c2c85f2c3dfcbca5d16877d61aca44d462f088a4a8baacacf59a3ae<\/li><\/ul>\n\n\n\n

          Contacted Addresses:<\/strong><\/p>\n\n\n\n

          • manvim[.]co <\/li>
          • 35.193.27[.]228 <\/li>
          • 63.141.228[.]141 <\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"

            LokiBot campaign of 21 June 2021: lure templates, dropper chain, exfiltration channels and IOC indicators across the latest waves.<\/p>\n","protected":false},"author":1,"featured_media":2687,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[17,3212,3320,198,205,3240,212,219,350],"class_list":["post-2664","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-35-193-27-228","tag-information-stealer","tag-june-2021","tag-keylogger","tag-lokibot","tag-malspam-campaign","tag-malware","tag-manvim-co","tag-threat"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2664","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=2664"}],"version-history":[{"count":1,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2664\/revisions"}],"predecessor-version":[{"id":9914,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2664\/revisions\/9914"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=2664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=2664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=2664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}