LokiBot Gains New Persistence Mechanism, Steganography
Tags
country: India
attack-pattern: Data Botnet - T1583.005 Botnet - T1584.005 Email Account - T1087.003 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Steganography - T1001.002 Steganography - T1406.001 Steganography - T1027.003 Visual Basic - T1059.005 Powershell - T1086 Windows Management Instrumentation - T1047
Show in Graph
Common Information
Type Value
UUID e971367a-8332-4116-ad34-2bf4174cf9d1
Fingerprint 236509850271dfcf
Analysis status DONE
Considered CTI value 2
Text language
Published Aug. 6, 2019, midnight
Added to db Oct. 16, 2024, 1:44 a.m.
Last updated Oct. 16, 2024, 1:45 a.m.
Headline LokiBot Gains New Persistence Mechanism, Steganography
Title LokiBot Gains New Persistence Mechanism, Steganography
Detected Hints/Tags/Attributes 54/2/9
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_sg/research/19/h/lokibot-gains-new-persistence-mechanism-uses-steganography-to-hide-its-tracks.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details File 1 
july.doc
Details File 5 
'package.json
Details File 2 
bpxssh.jpg
Details File 2 
sittey.jpg
Details File 2 
jkcgjj.jpg
Details sha256 2 
fd908abce7885430fb344aedb21cee0aa73f2bd7b82ab118974674afdfe45fc2
Details sha256 2 
84700ef750fa74f0837521037d4d5318274a5542b57e5ee92e27a168dd8938c4
Details sha256 2 
0a6e59e1d01521e4b0eb19faafe221737120183847a0fd6bc5a43f6fbc05d81f
Details IPv4 2 
37.49.230.149