LOKI DAOC BUILDER CRACKED
LOKI DAOC BUILDER INSTALL
LOKI DAOC BUILDER CODE

The added code in the вЂњ.xвЂќ section decrypts another C&C URL (which weвЂ™ve named вЂњPatched C2 URLвЂќ) then overwrites the original C&C URL (Figure 6).

LOKI DAOC BUILDER CRACKED

The HTA will then retrieve Loki as the final payload from hxxp://gamesarenagdn/games/Pasiexe.ДЇigure 5: Captured network traffic packet shows the RTF file that exploits CVE-2017-11882 and HTA dropper retrievalДЄ Cracked LokiWhile analyzing one of the final payloads, we saw extra code that tries to overwrite the original command-and-control (C&C) URL soon after the original code decrypts the C&C URL (shown in Figure 5). The remote object is a malformed Rich Text Format (RTF) document (named MS-word-2017pa.doc) that exploits CVE-2017-11882 and downloads an HTML Application (HTA) dropper from hxxp://gamesarenagdn/hta/WqJLhta. The remote object will be automatically linked and loaded once the victim clicks вЂњEnable EditвЂќ in Microsoft Word.ДЇigure 2: Sample spam email with the attached document serving as malicious dropperДЇigure 3: How the dropper appears to the user the malicious code will activate when the user clicks вЂњEnable EditingвЂќДЇigure 4: Code snippet showing the remote object being linked to the dropper

It is actually a dropper an Object Linking and Embedding (OLE) object embedded in the documents links to another malicious document, hxxp://gamesarenagdn/MS-word2017padoc. Infection ChainThe spam email poses as an Australian shipping company luring would-be victims to download an attached receipt in the form of an Office document. Affected regions include France, Hong Kong, the U.S., Croatia, India, Australia, South Korea, and Mauritius. For now, the campaign has specificity in their targets. ItвЂ™s possible that they use Loki as a conduit for further attacks, given LokiвЂ™s capability to steal email client credentials. This is illustrated by their use of compromised emails to send spammed messages to the accountвЂ™s contact list. But despite their use of pirated malware, this specific campaign appears to follow an operation model. We also saw advertisements on hacking groups touting an original Loki builder but were actually just cracked versions of it. Buyers need to pay more if they need additional functionalities (like Bitcoin wallet theft) or other services like domain/IP address change. The original service costs between $250 and $450. Perhaps it was the operatorsвЂ™ cost-saving tactic-a lifetime license for the cracked version, for instance, costs between $60 and $100 in hacking forums. The use of a pirated malware builder shows how thereвЂ™s no honor among thieves.

Loki also serves as a malware loader that can record keystrokes. It can also pilfer from IT administration tools like PuTTY, a terminal emulator, system console, and network file transfer application. Sold in hacking forums as a password and cryptocurrency wallet stealer, Loki can harvest data from File Transfer Protocol (FTP) clients (i.e., Filezilla), web browsers such as Firefox, Chrome and Safari, and email clients such as Outlook and Thunderbird.

LOKI DAOC BUILDER INSTALL

Another stood out to us: a recent campaign that used the same vulnerability to install a вЂњcrackedвЂќ version of the information-stealing Loki. We uncovered several others following suit in early December, delivering a plethora of threats that included Pony/ FAREIT, FormBook, ZBOT, and Ursnif. The Cobalt hacking group was one of the first to promptly and actively exploit CVE-2017-11882 (patched last November) in their cybercriminal campaigns. Additional analysis and insights from Fyodor Yarochkin and Joseph C.

Loki daoc builder