Lokibot

LokiBot is a malicious software, or malware, that was first reported on October 24, 2020. It is designed to exploit and damage computer systems by infiltrating them through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, LokiBot steals personal information and disrupts operations. The malware utilizes a complex, multi-stage, multi-layered dropper to execute on the victim's machine. Various versions of this dropper have been identified, each carrying different types of final payloads such as LokiBot itself for credential theft, Remcos for remote access, and others. The malware operates by collecting credentials from various sources within the infected system and storing them in a buffer inside the malware. These credentials are then sent to the Command and Control (C2) server. In one instance, a Microsoft Word document initiated a chain leading to the installation of Remcos RAT, while a similar attack chain deployed XWorm RAT through an Excel file and LokiBot through an RTF document. This RTF document exploits a vulnerability, specifically CVE-2017-11882, which enables the download and execution of LokiBot. The cybercrime group responsible for LokiBot has a wide array of tools and malware at their disposal, including AgentTesla, FormBook, Remcos, LokiBot, GuLoader, Snake Keylogger, and XWorm. The analysis revealed a plethora of final-stage payloads delivered by these droppers, including Leonem, AgentTesla, SnakeLogger, RemLoader, Sabsik, LokiBot, Taskun, Androm, Upatre, and Remcos. The campaign demonstrates a high degree of sophistication and poses a significant threat to data security.