{"id":13044,"date":"2020-03-03T08:07:19","date_gmt":"2020-03-03T02:37:19","guid":{"rendered":"https:\/\/antivirus.comodo.com\/blog\/?p=13044"},"modified":"2021-12-10T18:22:14","modified_gmt":"2021-12-10T12:52:14","slug":"coronavirus-push-lokibot-trojan-malware-unsuspecting-users","status":"publish","type":"post","link":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/","title":{"rendered":"Malware Authors now using Coronavirus to Push Lokibot Trojan on Unsuspecting Users"},"content":{"rendered":"
\n
\n
\n\"Coronavirus
\n
\n\n<\/div>\n

Latest attacks prove there are no depths to which scammers won\u2019t sink in order to steal from victims<\/em>.<\/p>\n

The Comodo Cyber Security research team recently discovered two opportunistic malware attacks which hope to take advantage of people\u2019s fears and sympathies over the Coronavirus. The attacks use the classic method of spamming<\/a> victims with an ostensibly trustworthy email containing malicious attachments and links. The first message reads \u201cWe are sorry for late response as our Holiday was extended due to the Corona Virus outbreak, as regards your la=t invoice, our account department has rejected payment for incorect accoun= information, please find attached your original invoice, double check and=send back for processing of payment<\/em>\u201d.<\/p>\n

The attached \u2018invoice\u2019 is, of course, malware. In this case it is a banking trojan called \u2018Lokibot\u2019 which hoovers sensitive data such as usernames and passwords from the user\u2019s browser. The second email has a Corona-related click-bait link which reads: \u201cBREAKING NEWS: Military Source Exposes Shocking TRUTH About Coronavirus and the 1 thing You Must Do Before It’s TOO LATE\u201d. Again, clicking the link causes the installation of the Lokibot malware.<\/p>\n

As you\u2019re undoubtedly aware by now, the Coronavirus is a deadly infection that is spreading fast around the world and has caused widespread public fear. Cybercriminals are trying to cash-in on the public interest around the virus by lacing the text of their phishing emails with Corona-related information.<\/p>\n

The Loki emails contain a malicious attachment which has the extension \u201c.pdf.gz\u201d, the attacker obviously hoping people assume it is a PDF and don\u2019t notice the .gz extension. The file installs the Lokibot banking trojan if the user opens the attachment. The trojan harvests sensitive information stored in internet browsers, including bank login details and other system information, which it then sends back to the malware authors.<\/p>\n

The following image is a screenshot of the first email which contains the Lokibot attachment:<\/p>\n

\"Lokibot<\/p>\n

The .gz attachment contains the following malicious executables:<\/p>\n

\"Malicious<\/p>\n

The second phishing mail takes a different approach, attempting to goad users into clicking a link by promising groundbreaking information about the Corona virus. The mail contains a striking image with the following headling:<\/p>\n

\u201cBREAKING NEWS Military Source Exposes Shocking TRUTH About Coronavirus And The “1 Thing” You Must Do Before It’s TOO LATE\u201d<\/em><\/strong><\/p>\n

\"Military<\/p>\n

The emails come from seemingly authoritative email addresses such as the following:<\/p>\n

AboutCoronavirus@foodlyystop.bid, AboutCoronavirus@nanopower.us, AboutCoronavirus@steeldefennse.us, MilitaryExposes@foodlyystop.bid, MilitaryExposes@steeldefennse.us,\u00a0 ShockingTRUTH@foodlyystop.bid, ShockingTRUTH@steeldefennse.us, CoronaProtection@guntracker.buzz,\u00a0Coronaprotection@savecertified.us, VirusProtection@guntracker.buzz<\/p>\n

However, clicking the link in the mail causes the installation of the Lokibot malware. Here are the signatures of the malicious files which form the Lokibot malware package:<\/p>\n

att-file0271_pdf.exe d3d609c2007850de58dd95dc573506f1f6c035a8
\neInvoicing_pdf.exe 5b6b7b2c91205fb530129cfdce98b02e61a240d3
\nINV-I202010301_pdf.exe 57f70011c2537cabc9e19ac25cad3a5327969154
\nINV-L55110_pdf.exe e12f1516bed85538db1a1760007039fc87f3c416
\nLoki1_protected_DD4FE6F.exe e786661aa8fbe82a7b515b5e5cc623f4141a7fc9
\nOrder_list_pdf.exe 53a2219bd0af7af19a1da619354eeb989bb91191
\nOriginal Invoice_pdf.exe 80c3f9968ecdc33d817040c781e075a19a681cdf
\nOriginal Shipping Documents_pdf.exe b7013f3cd7db4b82f122ca90e78dd7168910ea09
\nPayment_swift_952_pdf.exe 29d7fb10e7365c9a70fcc99a4154eaf462f9bf63
\nPO No. 104393019_pdf.exe 292b75ec0222df1fd19b85a72be1980029d94e48
\nscan-doc83618_pdf.exe 809ceaf0ceef8d418f4782f1a2bf3f9ff502f865
\nscan_03292019_pdf.exe 76ed1dab029bb1081e01ee8764310e61a7580c94<\/p>\n

Tips to avoid falling prey to malware spammers<\/h2>\n

Never click links in an email – ever.<\/strong> Even if it looks like a legit message from a company you do business with, you should ignore the link in the mail and instead log into your account through your browser or the company\u2019s app. If it\u2019s a genuine message, then the same message will be waiting for you in your online account.<\/p>\n

Some spam emails are very professional looking \u2013 they have your name correct, they have the right logos, the message content looks like previous emails from the company, and they even have a legal disclaimer at the bottom. For example, say you get a mail that looks like its from PayPal, stating there is a problem with your account and that you should click the following link to update your details. The login page it sends you to is fake. If you enter your username and password then you have handed your account details to the hacker, who can login to your account and drain your funds at will.<\/p>\n

If you receive a convincing looking mail and want to put your mind at ease, simply close the mail and separately login to your account through your browser by clicking your usual bookmark (or by typing the company\u2019s URL in the address bar). Any genuine message from the company will also be available in your online account. If you can\u2019t find any mention of it in your account, then the mail is bogus. In fact, you should follow this process for all email communications, even for real messages from the company in question, just to get yourself into the habit.<\/p>\n

Don\u2019t open email attachments.<\/strong> Online criminals often attach files to messages that have extensions like .pdf or .doc. In reality, they are viruses<\/a> or trojans which will infect your system, steal your confidential data, add your computer to a bot-net, or worse. Instead, follow the same process as described in the previous point. Ignore the attachment and the mail, and simply login to your account via your browser or the company app. If the message is legit, it will also be in your online account.<\/p>\n

Look out for bad grammar.<\/strong> As with almost all spam-malware, the Coronavirus mails contain several spelling and grammar mistakes. Simply put, large organizations like banks and other major businesses would never send out such a shoddily written, unprofessional looking mail to their customers. If the mail looks like it was written by a child, then it\u2019s a virtual dead-certainty that its spam-malware.<\/p>\n

\"Comodo<\/a><\/p>\n

Antivirus for Windows 10<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Latest attacks prove there are no depths to which scammers won\u2019t sink in order to steal from victims. The Comodo Cyber Security research team recently discovered two opportunistic malware attacks which hope to take advantage of people\u2019s fears and sympathies over the Coronavirus. The attacks use the classic method of spamming victims with an ostensibly […]<\/p>\n","protected":false},"author":5,"featured_media":13050,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[464,548,549,551,550,94,90],"class_list":["post-13044","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-computer-safety","tag-best-free-malware-protection","tag-coronavirus","tag-coronavirus-malware","tag-coronavirus-phishing-attacks","tag-covid-19","tag-email-security","tag-virus-protection"],"yoast_head":"\nCoronavirus to Push Lokibot Trojan Malware on Unsuspecting users<\/title>\n<meta name=\"description\" content=\"Cyber security experts warning about fast spreading coronavirus themed malware on unsuspecting users, it might be a trojan virus or worm. Know More.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coronavirus to Push Lokibot Trojan Malware on Unsuspecting users\" \/>\n<meta property=\"og:description\" content=\"Cyber security experts warning about fast spreading coronavirus themed malware on unsuspecting users, it might be a trojan virus or worm. Know More.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/\" \/>\n<meta property=\"og:site_name\" content=\"Comodo Antivirus Blogs | Anti-Virus Software Updates\" \/>\n<meta property=\"article:published_time\" content=\"2020-03-03T02:37:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-12-10T12:52:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/03\/coronavirus-push-lokibot-trojan-on-unsuspecting-users.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"seo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"seo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/\",\"name\":\"Coronavirus to Push Lokibot Trojan Malware on Unsuspecting users\",\"isPartOf\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/03\/coronavirus-push-lokibot-trojan-on-unsuspecting-users.jpg\",\"datePublished\":\"2020-03-03T02:37:19+00:00\",\"dateModified\":\"2021-12-10T12:52:14+00:00\",\"author\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462\"},\"description\":\"Cyber security experts warning about fast spreading coronavirus themed malware on unsuspecting users, it might be a trojan virus or worm. Know More.\",\"breadcrumb\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#primaryimage\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/03\/coronavirus-push-lokibot-trojan-on-unsuspecting-users.jpg\",\"contentUrl\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/03\/coronavirus-push-lokibot-trojan-on-unsuspecting-users.jpg\",\"width\":800,\"height\":500,\"caption\":\"Coronavirus push lokibot trojan on unsuspecting users\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/antivirus.comodo.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malware Authors now using Coronavirus to Push Lokibot Trojan on Unsuspecting Users\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#website\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/\",\"name\":\"Comodo Antivirus Blogs | Anti-Virus Software Updates\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/antivirus.comodo.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462\",\"name\":\"seo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g\",\"caption\":\"seo\"},\"url\":\"https:\/\/antivirus.comodo.com\/blog\/author\/seo\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Coronavirus to Push Lokibot Trojan Malware on Unsuspecting users","description":"Cyber security experts warning about fast spreading coronavirus themed malware on unsuspecting users, it might be a trojan virus or worm. Know More.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/","og_locale":"en_US","og_type":"article","og_title":"Coronavirus to Push Lokibot Trojan Malware on Unsuspecting users","og_description":"Cyber security experts warning about fast spreading coronavirus themed malware on unsuspecting users, it might be a trojan virus or worm. Know More.","og_url":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/","og_site_name":"Comodo Antivirus Blogs | Anti-Virus Software Updates","article_published_time":"2020-03-03T02:37:19+00:00","article_modified_time":"2021-12-10T12:52:14+00:00","og_image":[{"width":800,"height":500,"url":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/03\/coronavirus-push-lokibot-trojan-on-unsuspecting-users.jpg","type":"image\/jpeg"}],"author":"seo","twitter_card":"summary_large_image","twitter_misc":{"Written by":"seo","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/","url":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/","name":"Coronavirus to Push Lokibot Trojan Malware on Unsuspecting users","isPartOf":{"@id":"https:\/\/antivirus.comodo.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#primaryimage"},"image":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#primaryimage"},"thumbnailUrl":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/03\/coronavirus-push-lokibot-trojan-on-unsuspecting-users.jpg","datePublished":"2020-03-03T02:37:19+00:00","dateModified":"2021-12-10T12:52:14+00:00","author":{"@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462"},"description":"Cyber security experts warning about fast spreading coronavirus themed malware on unsuspecting users, it might be a trojan virus or worm. Know More.","breadcrumb":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#primaryimage","url":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/03\/coronavirus-push-lokibot-trojan-on-unsuspecting-users.jpg","contentUrl":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/03\/coronavirus-push-lokibot-trojan-on-unsuspecting-users.jpg","width":800,"height":500,"caption":"Coronavirus push lokibot trojan on unsuspecting users"},{"@type":"BreadcrumbList","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/coronavirus-push-lokibot-trojan-malware-unsuspecting-users\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/antivirus.comodo.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Malware Authors now using Coronavirus to Push Lokibot Trojan on Unsuspecting Users"}]},{"@type":"WebSite","@id":"https:\/\/antivirus.comodo.com\/blog\/#website","url":"https:\/\/antivirus.comodo.com\/blog\/","name":"Comodo Antivirus Blogs | Anti-Virus Software Updates","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/antivirus.comodo.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462","name":"seo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g","caption":"seo"},"url":"https:\/\/antivirus.comodo.com\/blog\/author\/seo\/"}]}},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/13044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/comments?post=13044"}],"version-history":[{"count":14,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/13044\/revisions"}],"predecessor-version":[{"id":16622,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/13044\/revisions\/16622"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/media\/13050"}],"wp:attachment":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/media?parent=13044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/categories?post=13044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/tags?post=13044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}