Discover and read the best of Twitter Threads about #LokiBot
Most recents (2)
Just found an unlisted Pastebin shared by @James_inthe_box listing 124 #lokibot URLs. Pastebin.com/SyeXWqQE #osint
If you want to learn more about LokiBot, check out this write up. threatfabric.com/blogs/lokibot_… #malware
If you want to learn more about my method of finding unlisted Pastebin pages, read here. jakecreps.com/2018/10/10/osi… #osint
#malspam campaign from 2.11 delivers both #LokiBot and #azorult interchangeably, archived in ISO files.
Files are packed with VB6 packer with file size of 524KB.
All C2 domains were active 31.10-2.11.
Sender: finances@ketmarine.nl
Subject: “Roxanne Heijt - Payment Swift Copy FYR”
Files are packed with VB6 packer with file size of 524KB.
All C2 domains were active 31.10-2.11.
Sender: finances@ketmarine.nl
Subject: “Roxanne Heijt - Payment Swift Copy FYR”
#LokiBot #IOCs:
virustotal.com/#/file/71156ab… -> jadak[.]cf/minel/fre.php
virustotal.com/#/file/e7e002f… -> barzenkiyader[.]cf/Panel/five/fre.php
virustotal.com/#/file/71156ab… -> jadak[.]cf/minel/fre.php
virustotal.com/#/file/e7e002f… -> barzenkiyader[.]cf/Panel/five/fre.php
#AZORult #IOCs:
virustotal.com/#/file/f559f89… -> welcome2nov[.]ga/mine/index.php
virustotal.com/#/file/75ecba2… -> welcome2novv[.]gq/tuneshi/index.php
virustotal.com/#/file/12da76d… -> goodnovember[.]ml/denyo/index.php
virustotal.com/#/file/f559f89… -> welcome2nov[.]ga/mine/index.php
virustotal.com/#/file/75ecba2… -> welcome2novv[.]gq/tuneshi/index.php
virustotal.com/#/file/12da76d… -> goodnovember[.]ml/denyo/index.php
