Loki Password Stealer (PWS)Malware
- burkina
- Loki
- LokiBot
- lokipws
"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMe Loki-Bot employs function hashing to obfuscate the libraries…From MISP Galaxy
Last reported 29 days ago, by SOCRadar4 reports
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1012Query Registry
“…, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.”
- T1036Masquerading
“Computer vision for button recognition, even including decoy images masquerading as buttons”
- T1056Input Capture
“Keystroke Input Capture via DirectInput”
- T1056.001Keylogging
“In this article, we will introduce the keylogger and keylogging detection features added this year to Elastic Defend (starting from version 8.12), which is responsible for endpoint protection in Elastic Security.”
- T1057Process Discovery
“Once running with elevated privileges, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.”
- T1059.001PowerShell
“The use of PowerShell is consistent with the MITRE ATT&CK technique T1059.001, though NCERT mapped to T1059.003 for this campaign.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Dark Web Profile: Blue Locker Ransomware“Proton has also been linked to the Loki Locker / BlackBit family and shows code overlap with the older Fonix ransomware.”
-
Protecting your devices from information theft“Some well-known malware with keylogging functionality includes Agent Tesla, LokiBot, and SnakeKeylogger.”
-
Managed upgrades. Enhance malware analysis efficiency with Group-IB Malware Detonation Platform updates“The example below (Figure 7) shows the successful detonation of the Loki PWS malware sample (sha1: 8247a571f464aadfc1ccbed4c3221316246a1fcc).”
-
Massive malicious campaign by FakeSecurity JS-sniffer“Based on the characteristics of the FakeSecurity campaign, it is possible that the admin panels of Lokibot and AZORUlt stealers, which were deployed on this server, were used in previous attacks conducted by this group in January 2019.”
Indicators in its reports
named in the reports above- protonmail[.]comin 1 report
- d3cc6cc4538d57f2…377cf1d0fadcin 1 report
- e6bd4ed287d13362…96d5d9e95a33in 1 report
- 6eeb20cc709a18bf…244886bbfd2ein 1 report
- 515bd71a8b3c2bce…dcdcb8a91ed9in 1 report
- 6af349a30f95e01b87cd7dd4ddc8e3fein 1 report
- 7e1cc4d2e4b35b95…4b6f7f2783d1in 1 report
- xmpp[.]jpin 1 report
- shinra-encrypt-support[.]xyzin 1 report
- blue-decryptor[.]sitein 1 report
- backup-leaks[.]funin 1 report
- 185.225.69[.]140in 1 report
- 195.3.145[.]99in 1 report
- 91.243.113[.]21in 1 report
- 103.150.199[.]23in 1 report
- 185.180.197[.]34in 1 report
- 45.155.205[.]233in 1 report
- 84.54.52[.]83in 1 report
- 185.212.128[.]88in 1 report
- 176.123.2[.]209in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.