#lokibot — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #lokibot, aggregated by home.social.
-
-
-
-
-
-
-
-
-
-
#lokibot (believe it or not) at:
https://ballotlinllc\.top/kellymnb/ENCRYPTED.ps1c2: http://91.92.243.\254/kelly/five/fre.php
65312b1b16f7928cbd0fa79bc12fe75dac2f610d13a54848a8b6f52d035f870d on the ps1
-
-
-
-
-
-
-
-
-
Some fresh (brace yourself...) #lokibot:
https://app.any.run/tasks/efb5efa2-f574-40e0-972f-b16c10d0b8cf/
a c2:
http://kbfvzoboss\.bid/alien/fre.php" -
-
-
-
-
-
-
-
-
-
Some fresh (and I can't believe I'm typing this) #lokibot:
https://app.any.run/tasks/054d7af5-64fc-4791-b5d4-0fbff689cf2f/
c2: http:// touxzw\.ir/fix/five/fre.php
-
🌐 Campagne #Malware in Italia - Week 49
📞 #APK Bank
🕵️♂️ #SpyNote / #Antidot / #Irata / #DroidBot / #SmSSpy
✉️ Email Campaigns
💼 #Formbook: Preventivo
📦 #AgentTesla: Spedizione
📑 #Remcos: Fattura
💰 #GuLoader: Pagamento
🧾 #XWorm: Fattura
🐍 #SnakeKeyLogger: Bonifico
🔖 #Lokibot: Prezzo
©️ #Rhadamanthys: Copyright
📄 #VipKeyLoggerL: Documento📢 Resta vigile! 🚨
-
-
-
-
Campagne #Malware #Italy Week 29
☠️💣🔥👻
#AgentTesla: Ordine
#Formbook: Offerta
#GuLoader: Fattura Elettronica
#Remcos: Bank
#Lokibot: Delivery
#SmokeLoader: Pagamenti
#Irata: Malware APK
#RedLine: Offerta
#Neshta: Ordine
#Ousaban: Processo
#SnakeKeylogger: Fattura -
-
Campagne #Malware #Italy Week 21
☠️🔥👻💣
#AgentTesla: Bozza Contratto
#RemcosRat: Ordine
#Formbook: Fattura
#SnakeKeylogger: Ordine
#GuLoader: Lisino
#Unknown: Contratto
#Lokibot: Delivery
#XWorm: Documentazione
#Ransomware: Cambiare Rotta
#mwitaly -
-
-
Have you seen The Empire in your network?
A #cybercrime group, registered under “EVILEMPIRE”, is hosting dozens of #C2 servers between 185.172.128.0-185.172.128.255 including:
#RedLineStealer #LokiBot #HookBot #RisePro #Amadey #CobaltStrike #AsyncRAT #AMOSDon’t let your computers enlist! Block 185.172.128.0/24 🔥
-
-
#LokiBot, un #malware da 80 dollari: ecco perché è così diffuso e come difendersi https://www.cybersecurity360.it/nuove-minacce/lokibot-malware-80-dollari/
-
Campagne #Malware #Italy Week 41
🔥💣☠️#SpyNote: fake APK It-Alert
#AgentTesla: Listino
#Formbook: Ordine
#Lokibot: Preventivo
#IcedID: Resend PDF
#RemcosRat - ScreenConnect: Fattura PDF -
Campagne #Malware #Italy Week 41
🔥 Persistenti
#Ursnif: #AgenziaEntrate
#DarkGate: Resend link a ZIP
#AgentTesla: Pagamento💣 D'eccezione
#RemcosRat: Pagamento
#Lokibot: Bank
#ScreenConnect: Fattura PDF -
Campagne #Malware #Italy Week 28 🔥
#AgentTesla: Proposta d'Ordine
#RemcosRAT: Pagamento
#Formbook: Banca
#Rhadamanthys: Sollecito
#Ursnif: Invoice
#Lokibot: Preventivo
#IcedID: Resend -
Today in our section on "uncoventional #Malware delivery": #ARJ archives! 📦
ARJ (Archived by Robert Jung) has been around since the MS-DOS days and is occasionally used to deliver e.g. #AgentTesla, #Formbook or #GuloaderYou can recognize ARJ archives by their Magic: 60 EA
Extraction can be handled with 7zip for example.
For more information on the file format check out Ange Albertini's excellent graphic representation: https://twitter.com/angealbertini/status/1619006171360395264As an example we dug up a #Lokibot sample from last year where the delivery chain looked like this: ARJ --> RAR --> EXE
To fool the victims into opening the next file they used the common #doubleExtension tick, e.g. .pdf.exeIoC for those playing along at home:
162.0.223[.]13
kbfvzoboss[.]bid
alphastand[.]trade
alphastand[.]win
alphastand[.]top
➡️/alien/fre.phpPO_Payment for invoice[...].eml.arj
d0c8824d1e19ca1af0b88a477fa4cad6SHIPPING_DL-PL-EXPRESS_EXPORT.PDF.exe
88bdf4f8fe035276da984c370e4cda2c -
Власти США предупредили о всплеске атак LokiBot #LokiBot, #CISA https://www.securitylab.ru/news/512397.php https://twitter.com/SecurityLabnews/status/1308744183503564800/photo/1
-
Trend Micro descubren una campaña del #malware #LokiBot disfrazada de launcher falso de Epic Games. Se distribuye a través de mails #phishing y utiliza una instalación inusual para evitar la detección (ENG) https://www.zdnet.com/article/new-lokibot-trojan-malware-campaign-comes-disguised-as-a-popular-game-launcher/ vía @[email protected] #ciberseguridad #EpicGames #TrendMicro
-
New attack spreads LokiBot & NanoCore malware in ISO image files https://www.hackread.com/new-attack-spreads-lokibot-nanocore-malware-in-iso-image-files/