Infostealer
Loki Password Stealer (PWS)
aka Burkina · Loki · LokiBot · LokiPWS
"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST.
Loki Password Stealer (PWS), also known as Burkina, Loki, LokiBot, LokiPWS, is a Windows infostealer operated by SWEED, The Gorgon Group and others.
Background
Per PhishMe, Loki Bot is commodity malware traded on underground marketplaces that harvests private data from compromised hosts and relays it to a command-and-control server through HTTP POST. The stolen material covers saved passwords, browser login credentials, and a range of cryptocurrency wallets.
To conceal the libraries it relies on, Loki-Bot applies function hashing; although not every function is hashed, the great majority are.
Loki-Bot recognizes a single ‘-u’ switch, which merely sleeps execution for 10 seconds. This is invoked when the malware upgrades itself.
Its mutex is produced by MD5-hashing the Machine GUID and truncating the result to 24 characters, for example: “B7E1C2CC98066B250DDB2123“.
Within %APPDATA%, Loki-Bot makes a hidden folder named from the 8th through 13th characters of the mutex, for example: “%APPDATA%\ C98066\”.
At any moment this hidden %APPDATA% folder may hold up to four files: “.exe,” “.lck,” “.hdb” and “.kdb.” Each is named after characters 13 through 18 of the mutex, for example: “6B250D.” Their roles are described below:
FILE EXTENSION FILE DESCRIPTION .exe A copy of the malware that will execute every time the user account is logged into .lck A lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts .hdb A database of hashes for data that has already been exfiltrated to the C2 server .kdb A database of keylogger data that has yet to be sent to the C2 server
When the account is privileged, Loki-Bot establishes persistence in the registry under HKEY_LOCAL_MACHINE; otherwise it persists under HKEY_CURRENT_USER.
Loki-Bot's first outbound packet carries application data.
The second packet it sends holds decrypted Windows credentials.
In its third packet, Loki-Bot polls the C2 server for commands. By default it repeats this request every 10 minutes after the initial transmission.
Traffic from the infected host to the C2 conveys details about the user and machine, such as the username, hostname, domain, screen resolution, privilege level, system architecture, and operating system.
The opening WORD of the HTTP payload indicates the Loki-Bot version.
The next WORD of the HTTP payload denotes the Payload Type. The recognized payload types are listed below:
BYTE PAYLOAD TYPE 0x26 Stolen Cryptocurrency Wallet 0x27 Stolen Application Data 0x28 Get C2 Commands from C2 Server 0x29 Stolen File 0x2A POS (Point of Sale?) 0x2B Keylogger Data 0x2C Screenshot
Starting at the 11th byte of the HTTP payload is the Binary ID, which can help track campaigns or particular threat actors. It is usually set to “ckav.ru”; a Binary ID differing from this is worth noting.
Loki-Bot uses Triple DES encryption to protect both the URL and the registry key it uses for persistence.
The Content-Key HTTP header value is derived by hashing the preceding HTTP header values, most likely to deter researchers from probing Loki-Bot's C2 infrastructure.
Loki-Bot understands the following instructions issued by the C2 server:
BYTE INSTRUCTION DESCRIPTION 0x00 Download EXE & Execute 0x01 Download DLL & Load #1 0x02 Download DLL & Load #2 0x08 Delete HDB File 0x09 Start Keylogger 0x0A Mine & Steal Data 0x0E Exit Loki-Bot 0x0F Upgrade Loki-Bot 0x10 Change C2 Polling Frequency 0x11 Delete Executables & Exit
Suricata Signatures RULE SID RULE NAME 2024311 ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected 2024312 ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M1 2024313 ET TROJAN Loki Bot Request for C2 Commands Detected M1 2024314 ET TROJAN Loki Bot File Exfiltration Detected 2024315 ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M1 2024316 ET TROJAN Loki Bot Screenshot Exfiltration Detected 2024317 ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M2 2024318 ET TROJAN Loki Bot Request for C2 Commands Detected M2 2024319 ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2
Source: Malpedia (Fraunhofer FKIE).