LokiBot Trojan Spotted Hitching a Ride Inside .PNG Files

guest · Apr 5, 2019

LokiBot Trojan Spotted Hitching a Ride Inside .PNG Files
Spam campaign features obfuscated .zipx archive that unpacks LokiBot attack
April 5, 2019
https://threatpost.com/lokibot-trojan-spotted-hitching-a-ride-inside-png-files/143491/

A spam campaign pushing the info-stealing LokiBot trojan leverages a novel technique to avoid detection. According to researchers, the spam messages include malicious .zipx attachment hidden inside a .PNG file that can slip past some email security gateways.

According to Trustwave SpiderLabs, that first spotted the .PNG/LokiBot messages, the spam campaigns delivering the trojan have been limited in scope, so far. “This represents an extension to the existing ways LokiBot is delivered via email,” said Phil Hay, senior research manager at Trustwave.
Unique Obfuscation
First, the attachment used in the spam campaign has a .zipx extension, meaning it is a compressed archive. [...] In an attempt to avoid detection, hackers behind the malspam trick email security gateway scanners by obfuscating the archive, using the file signature of a .PNG (portable network graphics) format.

“The wider point is that, because it is hidden in a real PNG file, it may not be recognized as a Zip archive, and therefore gateways may simply ignore it,” according to researchers.
Click to expand...

Trustwave: Spammed PNG file hides LokiBot

guest · Aug 7, 2019

Lokibot Uses Image Files to Hide Code for Unpacking Routine
August 7, 2019
https://www.bleepingcomputer.com/ne...age-files-to-hide-code-for-unpacking-routine/

The authors behind LokiBot info-stealer have turned to steganography to add a new layer of obfuscation, the researchers discovered in a recent variant of the malware.

It can steal browser information from over 25 different products, check for remote administration tools (SSH, VNC, RDP), and find credentials for email and file transfer clients.
Researchers at Trend Micro discovered that new strains of LokiBot use image files to hide code needed for its unpacking routine.

The analysis showed that the image hosted the encrypted binary the malware needs for different unpacking stages, which lead to LokBot being decrypted in the RAM of the infected system.
The researchers note that this strategy not only enables LokiBot to evade detection but also helps it with persistence on the compromised machine.
Click to expand...

Trend Micro: LokiBot Gains New Persistence Mechanism, Uses Steganography to Hide Its Tracks

Log in or Sign up

LokiBot Trojan Spotted Hitching a Ride Inside .PNG Files

guest Guest

guest Guest

Log in or Sign up

LokiBot Trojan Spotted Hitching a Ride Inside .PNG Files

guest Guest

guest Guest

Useful Searches