LodaRAT Update: Alive and Well
Summary: Cisco Talos identified new versions of LodaRAT, an AutoIt-written remote access trojan, that drop the string obfuscation and function name randomization used in earlier versions and are distributed through phishing emails carrying RAR attachments renamed with a ".rev" extension. One version added a hex-encoded PowerShell keylogger and a VB script to enforce a single running instance, while a version labeled 1.1.7 removed both and focused on stealing browser passwords and cookies, with command-and-control traffic moving to ngrok.io and portmap.io.
Key Takeaway: During analysis of version 1.1.1, the threat actor watched the screenshots Loda sent back, recognized the machine as a sandbox from the image alone, and pushed a custom message box to it - direct evidence that someone is actively monitoring infected hosts, not just collecting from them.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2017-11882
- Related
- Loda RAT Grows Up Cyber Risks ·CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021