Loda Trojan revitalized with stealthy upgrade, new exploits

guest · Feb 13, 2020

Loda Trojan revitalized with stealthy upgrade, new exploits
February 13, 2020
https://www.zdnet.com/article/loda-trojan-leaves-infancy-with-revamped-obfuscation-exploits/

Researchers have documented the evolution of Loda, a Remote Access Trojan (RAT) which is leaving its simple roots to become an established threat in the US and other countries.

Loda was first observed in 2016. According to Proofpoint, the AutoIT-based RAT is able to access and exfiltrate both system and user information, act as a keylogger, take screenshots, launch and close processes, and download additional malware payloads via a connection to a command-and-control (C2) server.

The latest variant of Loda, version 1.1.1, has revamped obfuscation techniques to improve its stealth capabilities and new mechanisms are also in play to maintain persistence on systems after shutdown.
While similar to past versions, the majority of Loda's strings and variables are now encoded and the malware is able to perform WMI queries to detect installed antivirus software.
Click to expand...

The attack begins with a common technique, a phishing email, which contains a first-stage malicious document as an attachment.
If downloaded, the second document will attempt to exploit CVE-2017-11882, a memory corruption vulnerability found in Microsoft Office [...]
Should an infection attempt prove to be successful, a malicious MSI file is served to the victim containing the Trojan.

"Loda is simple yet has proven to be effective, and poses a serious threat to an infected host," the researchers say. "The credential-stealing capabilities could lead to significant financial loss or a potential data breach. [..] and the change in persistence mechanisms and AV solution detection show that the malware authors are actively improving the functionality of Loda."
Click to expand...

Cisco Talos: Loda RAT Grows Up

guest · Sep 30, 2020

LodaRAT Update: Alive and Well
Cisco Talos observed changes in the threat that add new functionality
September 29, 2020
https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html

What's New?
Talos recently identified new versions of LodaRAT, a remote access trojan written in AutoIt. Not only have these versions abandoned their usual obfuscation techniques, but several functions have also been rewritten and new functionality has been added. In one version, a hex-encoded PowerShell keylogger script has been added, along with a new VB script, only to be removed in a later version. Direct interaction from the threat actor was observed during analysis.
So What?
Since our blog post on Loda in February 2020, Talos has been continually monitoring LodaRAT for new behavior. Recently there have been several changes that indicate that the authors are learning new techniques to improve the effectiveness of Loda. While these changes are somewhat minor, it shows that the authors are continually developing Loda into a more robust RAT.
Click to expand...

The most readily apparent change in these new iterations of Loda is the complete removal of any obfuscation.
The unobfuscated versions analyzed in this post are quite rare in comparison to previous versions. The frequency of use may increase over time if the new iterations of Loda prove to be effective.

This malware poses a serious threat to an infected host due to its capabilities. Loda may be simple, but it is more than effective enough to cause serious financial damage.
Click to expand...

guest · Nov 17, 2022

LodaRAT Malware Evolves With New Functionalities
By Lindsey O’Donnell-Welch - November 17, 2022

The LodaRAT malware - a known remote access trojan with extensive data collection and exfiltration capabilities - has steadily evolved over the years with new functionalities, and the malware is being increasingly deployed alongside other malware families, indicating that the RAT has garnered interest from various threat actors, according to new research.
Click to expand...

First discovered in September 2016, the remote access trojan comes with a number of capabilities for spying on victims, such as recording the microphones and webcams of victims’ devices. The RAT, which is written in AutoIT, appears to be distributed by multiple cybercrime groups that have been using it to target numerous verticals.

The malware has continually evolved over the years, improving its espionage capabilities for Android and Windows systems, for instance. On Thursday, researchers said that new LodaRAT variants uncovered in the wild shows more changes to the malware, with the addition of some functionalities and removal of others.

“While some of these changes appear to be purely for an increase in speed and efficiency, or reduction in file size, some changes make Loda a more capable malware,” said researchers with Cisco Talos on Thursday.
“Many of the LodaRAT samples we analyzed have removed functionality in some way, which may be the author’s attempt to reduce detection rates.”
Click to expand...

Cisco Talos: Get a Loda This: LodaRAT meets new friends

By Chris Neal - November 17, 2022

LodaRAT samples were deployed alongside other malware families, including RedLine and Neshta.

Cisco Talos identified several variants and altered versions of LodaRAT with updated functionality have been seen in the wild.

Changes in these LodaRAT variants include new functionality allowing proliferation to attached removable storage, a new string encoding algorithm and the removal of “dead” functions

A relatively unknown VenomRAT variant named S500 has been observed deploying LodaRAT.

Since our first blog post in February of 2020 on the remote access tool (RAT) known as LodaRAT (or Loda), Cisco Talos has monitored its activity and covered our findings in subsequent blog posts, listed below: [...]
Click to expand...

Log in or Sign up

Loda Trojan revitalized with stealthy upgrade, new exploits

guest Guest

guest Guest

guest Guest

Log in or Sign up

Loda Trojan revitalized with stealthy upgrade, new exploits

guest Guest

guest Guest

guest Guest

Useful Searches