Loda RAT Grows Up
Summary: Cisco Talos analyzed Loda RAT version 1.1.1, which is delivered through a two-stage document chain: a phishing attachment with an OOXML relationship to a second document that exploits CVE-2017-11882, then downloads and runs an MSI containing the RAT. The new version changes its AutoIT string obfuscation, adds both a registry key and a scheduled task for persistence, and uses a WMI query to SecurityCenter2 to enumerate installed antivirus, while still stealing browser credentials and cookies and adding FileZilla recentservers.xml theft.
Key Takeaway: Talos reports that simply repackaging a malicious executable as an MSI can drop its VirusTotal detection rate by up to 50 percent, and telemetry shows this campaign's C2 traffic going back to the last quarter of 2019, with queries to 4success[.]zapto[.]org and success20[.]hopto[.]org originating from Brazil, Costa Rica, Argentina and the United States.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2017-11882
- Related
- LodaRAT Update: Alive and Well Cyber Risks ·CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021