Pierluigi Paganini June 26, 2019

Experts from security firm Netskope observed variants of LokiBot and NanoCore malware distributed in ISO Image through malspam campaign.

Security firm Netskope observed a new malspam campaign delivering variants of LokiBot and NanoCore malware in ISO image file attachments.

“Netskope Threat Research Labs has been tracking multiple similar malspam campaigns that began in  April 2019. The spam campaign contains an ISO image file as an attachment containing the next level payload.” reads the analysis published by Netskope.

The malspam campaign began in April 2019, victims received a generic message about an invoice using an ISO disk image file attachment. The spam campaign doesn’t appear to be targeted to particular individuals or enterprises.

The distribution of both malware via spam messages using attached ISO image files is unusual.

“The observed ISO files were in the size range of 1MB to 2MB which is an unusual file size for image files; usually, their sizes are in the upwards of 100MB. The image contains only one executable file embedded in it which is the actual malware payload.” continues the analysis.

Netskope detected roughly ten variants in the current campaign, using different ISO images and email messages.

LokiBot was delivered as a file using the old .com extension, likely to deceive the victims. Experts pointed out that the current version of Loki is similar to its previous ones, but with some modifications for the implementation of evasion techniques. 

The sample analyzed by the experts uses the IsDebuggerPresent() function to determine if it is loaded inside a debugger and attempt to check if it is executed in a VM by measuring the computational time difference between CloseHandle() and GetProcessHeap().

The LokiBot data stealer is able to collect information from more than 25 different web browsers, access to browsing data, locate the credentials for more than 15 different email and file transfer clients, and check for the presence of popular remote admin tools like SSH, VNC and RDP.

The same campaign also involved a version of NanoCore RAT built using AutoIT as a top-level wrapper for the main .NET compiled binary. The decompiled AutoIT script is heavily obfuscated, it constructs the actual .NET binary of the NanoCore RAT.

Nanocore RAT is a “general purpose” malware with specific client factories available to everyone and easily accessible. It has a modular structure and has been active since 2013. Its features could be expanded by additional plugins. 

“Malspam campaign continues to mix and match various new and old techniques to stay relevant. Choosing an image file as an attachment indicates that they are intending to defeat email filters and scanners who generally whitelist such file types.” concludes the analysis. “Use of commercially available malware payloads shows that the use of such tools has not slowed down despite crackdowns by law enforcement on individuals responsible for creating them.”

Pierluigi Paganini

(SecurityAffairs – LokiBot, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]