LokiBot and NanoCore Malware Distributed in ISO Image Files

guest · Jun 25, 2019

LokiBot and NanoCore Malware Distributed in ISO Image Files
June 25, 2019
https://www.securityweek.com/lokibot-and-nanocore-malware-distributed-iso-image-files

LokiBot info-stealing malware is again being distributed in a malspam campaign using attached ISO image file attachments. Similar was reported in August 2018, but it remains an unusual method of distribution. This new campaign is also separately distributing NanoCore.

"The observed ISO files were in the size range of 1MB to 2MB which is an unusual file size for image files," they say in a report.
So far, Netskope has detected around ten variants in the current campaign, using different ISO images and emails. The content has almost always been either LokiBot or NanoCore.

However, if the email gets through to the user's inbox, the advantage is with the attackers. This could be common since ISO files are often whitelisted in scanning engines. Furthermore, if the target does not recognize it as suspicious, and clicks on the attachment, many operating systems will automatically detect and mount the image.
Click to expand...

The continuing use of old malware and the reuse of old distribution methods suggests that users are still not learning how to detect spam and phishing emails, nor employing adequate anti-malware tools to block them.
Click to expand...

Log in or Sign up

LokiBot and NanoCore Malware Distributed in ISO Image Files

guest Guest

Log in or Sign up

LokiBot and NanoCore Malware Distributed in ISO Image Files

guest Guest

Useful Searches