LodaRAT Variants Add Removable-Drive Propagation and Appear Alongside Other Malware
Summary
Cisco Talos analyzes altered LodaRAT variants, including removable-drive propagation and changed string decoding, and reports deployments alongside S500, RedLine and Neshta.
Key points
- Recent LodaRAT variants can identify Windows 11 hosts, copy files to connected removable drives, and use a revised string-decoding method.
- Some variants remove or alter functions, including the PowerShell keylogger and a broken SQLite3 download routine; one rewrote antivirus-process detection.
- A previously undocumented VenomRAT variant, S500, was observed decrypting and dropping LodaRAT. S500 can also copy browser profiles.
- In one infection chain, Neshta infected executable files and dropped a packed payload containing RedLine and LodaRAT.
- Talos says LodaRAT is easy to customize because compiled AutoIt scripts can be decompiled; it expects further variants and bundled deployments.
- Talos lists Snort SID 53031 and ClamAV signatures for detection, and provides file hashes and infrastructure indicators.
Article Details
- Attack Vectors
- LodaRAT variants can copy their files to every mounted removable storage device, potentially spreading through attached storage.
- The S500 sample stored LodaRAT as an encrypted resource and decrypted and dropped it on the infected host after execution.
- Neshta infected executable files by prepending itself to them, causing it to execute when an infected file was run.
- A Neshta payload contained RedLine and LodaRAT in a packed overlay; execution unpacked and ran both payloads.
- LodaRAT samples were also observed deployed alongside RedLine and Neshta.
- Defensive Notes
- Cisco Talos recommends using Cisco Secure Endpoint to prevent execution of the malware described.
- Cisco Secure Web Appliance and Umbrella can block or detect access to malicious websites, domains, IPs, and URLs associated with the threat.
- Cisco Secure Firewall products, Cisco Secure Malware Analytics, Cisco Secure Email, and Snort rules are listed as additional detection or blocking options.
- The article identifies Snort SID 53031 and the ClamAV signatures Txt.Malware.LodaRAT-9769386-0, Win.Malware.Bulz-9880537-0, Win.Trojan.Neshuta-1, and Win.Malware.Zbot-9977624-0 as applicable.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | catkiller7767-64721[.]portmap[.]io | Domain listed as an IOC for this threat research. |
| DOMAIN | judithabusufaitdyg[.]duckdns[.]org | Domain listed as an IOC for this threat research. |
| IPV4 | 193[.]161[.]193[.]99 | IP address listed as an IOC for this threat research. |
| SHA256 | 50e2444e832e4c3ed711fcf27c038967c2c5f5037a4e0ea2cc6d53ef6ac54cfb | RedLine file hash listed in the article's IOCs. |
| SHA256 | ac3c94d88bcd4833d6fc5ffde7379f90a8915863567990572f2fa0d7fe83d0da | LodaRAT file hash listed in the article's IOCs. |
| SHA256 | c73771b3b8c6e548724dd02e5f12380a9160323d88dbdbe12d388ade0f7bc1e2 | Hash of the altered Loda variant, identified in the article as the S500 + LodaRAT sample. |
| SHA256 | cd6a8e6b17a1ecb5aafb24ef4f7ec0ba0be44508ea10dbde551e0037220571f8 | Hash of the Neshta + LodaRAT + RedLine sample listed in the article's IOCs. |
| SHA256 | e6bf1b38f9d4b2a2aeb00dc4c12dd22eff26c318665687b4653fe8269d39d878 | LodaRAT file hash listed in the article's IOCs. |
MITRE ATT&CK
T1059.010 · AutoHotKey & AutoITLodaRAT is written in AutoIt and its compiled binaries can be executed on Windows.T1082 · System Information DiscoveryLodaRAT detects Windows 11 and sends the host-version information in its initial C2 beacon.T1091 · Replication Through Removable MediaA LodaRAT variant copies its files to all mounted removable storage devices.T1518.001 · Security Software DiscoveryA Loda variant searches for anti-malware product processes.
People
Threat Actors
Malware
LodaRATGet a Loda This: LodaRAT meets new friendsNeshtaLodaRAT samples were deployed alongside other malware families, including RedLine and Neshta.RedLineLodaRAT samples were deployed alongside other malware families, including RedLine and Neshta.S500A relatively unknown VenomRAT variant named S500 has been observed deploying LodaRAT.S500RATDuring our research, we observed a previously undocumented VenomRAT variant named S500 (or S500RAT) dropping LodaRAT. Like VenomRAT, S500 is a .NET commodity malware with Hidden Virtual Network Computing (HVNC)VenomRATA relatively unknown VenomRAT variant named S500 has been observed deploying LodaRAT.
Vendors
AVG“Norman Virus Control” - Discontinued software from Norman Data Defense Systems, acquired by AVGByteHero Information Security Lab“ByteHero” - Discontinued product from ByteHero Information Security Lab, based in ChinaCiscoCisco Talos identified several variants and altered versions of LodaRAT with updated functionality have been seen in the wild.Hacksoft“The Hacker” - Discontinued product from a Peruvian company named HacksoftNorman Data Defense Systems“Norman Virus Control” - Discontinued software from Norman Data Defense Systems, acquired by AVGWebroot“Prevx” - Discontinued product from Webroot
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.ClamAVThe following ClamAV signatures are applicable to this threat:Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Microsoft WindowsKasablanka Group's LodaRAT improves espionage capabilities on Android and WindowsSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat areSQLite3One of these dead functions is “__SQLITE_DOWNLOAD_SQLITE3DLL”, which downloads an x64 SQLite3 DLL from the official AutoIt website.Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.Windows Media PlayerWhen LodaRATreceives this command from C2, it attempts to stream audio in Windows Media Player from a Microsoft Media Server (MMS) at the URL shown below: