{"id":2970,"date":"2021-07-26T12:17:45","date_gmt":"2021-07-26T10:17:45","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2970"},"modified":"2026-06-08T22:56:12","modified_gmt":"2026-06-08T22:56:12","slug":"lokibot-campaign-update-july-2021","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/lokibot-campaign-update-july-2021\/","title":{"rendered":"LokiBot campaign \u2014 update of 26 July 2021"},"content":{"rendered":"\n

In the past week, a phishing<\/strong> campaign targeting Italy has been detected.
The email subject line reads “RE: Purchase order-12034428 HANG TAG ARTWORK”; the attachment contains an xlsx<\/strong> file that, when opened, contacts a domain from which it downloads a LokiBot<\/strong> sample in exe format.<\/p>\n\n\n\n

\"Immagine\"
Source: JAMESWT (@JAMESWT_MHT) \/ Twitter<\/a> <\/figcaption><\/figure>\n\n\n\n

The dropper<\/strong> xlsx exploits CVE-2017-11882<\/strong> (Cyber Threat Intelligence<\/a>), which permits arbitrary code execution. In this instance, the Microsoft Equation Editor process (EQNEDT32.EXE) is leveraged to contact http:\/\/weddingstory[.]gr\/linto\/vulinko[.]exe<\/strong>, download the LokiBot<\/strong> sample to “\\AppData\\Roaming\\gtyhyz.exe”, and execute it.<\/p>\n\n\n\n

\"\"
Source: PTTXSAMPLEXANDXPO.xlsx (MD5: A4025253BAA6223DD98E753812AC621C) – Interactive analysis – ANY.RUN<\/a> <\/figcaption><\/figure>\n\n\n\n

The malware is an infostealer and RAT<\/strong> capable of harvesting user credentials and establishing a backdoor<\/strong> to permit the attacker to deploy additional malicious payloads.
For instance, it exfiltrates credentials stored in browsers: AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\qldyz51w.default\\pkcs11.txt.<\/p>\n\n\n\n

This information is subsequently transmitted to the Command and Control (C2) server, identified as lushbb[.]xyz<\/strong> at IP address 104[.]21[.]51[.]229<\/strong>.<\/p>\n\n\n\n

Static Analysis<\/h2>\n\n\n\n

File xlsx<\/h3>\n\n\n\n

Tag<\/h5>\n\n\n\n

Dropper<\/span><\/span><\/mark><\/p>\n\n\n\n

Details<\/h5>\n\n\n\n
md5<\/strong><\/td>A4025253BAA6223DD98E753812AC621C<\/td><\/tr>
sha1<\/strong><\/td>01E842B2443B1ACD25D6D65595C4D3F9339654D9<\/td><\/tr>
sha256<\/strong><\/td>DA3F3359E2448D36BDD8B0EBDF074FB608F8BE4FC9D996FAEAD58E6B6D819E67<\/td><\/tr>
file-size<\/strong> <\/td>768 644 (bytes)<\/td><\/tr>
entropy <\/strong><\/td>7.998<\/td><\/tr>
Virustotal <\/strong><\/td> score 29\/62<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Description<\/h5>\n\n\n\n

Email attachment exploiting CVE-2017-11882<\/strong> to download and execute the LokiBot sample.<\/p>\n\n\n\n

vulinko.exe <\/h3>\n\n\n\n
Tag<\/h5>\n\n\n\n

LokiBot<\/span><\/span><\/p>\n\n\n\n

Details<\/h5>\n\n\n\n
md5<\/strong><\/td>A4025253BAA6223DD98E753812AC621C<\/td><\/tr>
sha1<\/strong><\/td>01E842B2443B1ACD25D6D65595C4D3F9339654D9<\/td><\/tr>
sha256<\/strong><\/td>DA3F3359E2448D36BDD8B0EBDF074FB608F8BE4FC9D996FAEAD58E6B6D819E67<\/td><\/tr>
file-size<\/strong><\/td>768 644 (bytes)<\/td><\/tr>
entropy<\/strong><\/td>7.998<\/td><\/tr>
imphash<\/strong><\/td>2BD8836AD04E575E33CBFFF8CBA9F900<\/td><\/tr>
Virustotal<\/strong><\/td>score 28\/70<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Description<\/strong><\/p>\n\n\n\n

LokiBot<\/strong> sample performing data exfiltration and communicating with the C2 server at address 104[.]21[.]51[.]229<\/strong>.<\/p>\n\n\n\n

IOCs<\/h2>\n\n\n\n
PTTXSAMPLEXANDXPO.xlsx<\/h5>\n\n\n\n
  • SHA256<\/strong> DA3F3359E2448D36BDD8B0EBDF074FB608F8BE4FC9D996FAEAD58E6B6D819E67  <\/li>
  • SHA1 <\/strong>01E842B2443B1ACD25D6D65595C4D3F9339654D9  <\/li>
  • MD5 <\/strong>A4025253BAA6223DD98E753812AC621C <\/li><\/ul>\n\n\n\n
    Downloaded Executable (LokiBot)<\/h5>\n\n\n\n
    • SHA256 <\/strong>3353C2EA708D348C56FACAAB5C7AEBB5A2EC6C820D076D25DC41F30FAC712F6D <\/li><\/ul>\n\n\n\n
      Network Activity<\/h5>\n\n\n\n
      • Dropper <\/strong>
        • weddingstory[.]gr   <\/li>
        • 51[.]15[.]17[.]195 <\/li><\/ul><\/li>
        • C2 <\/strong>
          • lushbb[.]xyz  <\/li>
          • 104[.]21[.]51[.]229 <\/li><\/ul><\/li><\/ul>\n\n\n\n

            Phishing campaigns leveraging CVE-2017-11882 through Office documents remain a persistent delivery vector for infostealer malware; defenders must maintain vigilance against email-borne threats employing equation editor exploitation and implement application whitelisting to restrict arbitrary code execution.<\/p>\n","protected":false},"excerpt":{"rendered":"

            LokiBot campaign update: lure templates, payload delivery patterns, info-stealer capabilities and indicators across the latest waves observed in July 2021.<\/p>\n","protected":false},"author":1,"featured_media":2980,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[3094,3212,205,3240],"class_list":["post-2970","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-credential-theft","tag-information-stealer","tag-lokibot","tag-malspam-campaign"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=2970"}],"version-history":[{"count":1,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2970\/revisions"}],"predecessor-version":[{"id":9885,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2970\/revisions\/9885"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=2970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=2970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=2970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}