The Koadic Trojan is a dangerous Python-based RAT that can cause serious damage to infected hosts. It consists of a modular engine and plugins that add to its functionality. Read our in-depth article to learn more about it.
Threat Summary
| Name | Koadic Trojan |
| Type | Trojan, Ransomware, Cryptocurrency Miner |
| Short Description | The Koadic Trojan is capable of spying on the users and their machines and harvest sensitive data from it. |
| Symptoms | Depending on the case the users may experience unusual performance issues. |
| Distribution Method | Spam Emails, Email Attachments |
| Detection Tool | See If Your System Has Been Affected by malware Download Malware Removal Tool | User Experience | Join Our Forum to Discuss Koadic Trojan. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
Koadic Trojan – Distribution Methods
The Koadic Trojan is a platform that was first presented at the Defcon security conference by its developers — Sean Dillon and Zach Harding. By itself it is not created by hackers or appears in the underground hacker communities supported by them.
This means that the main delivery method is probably to acquire a sample copy of Koadic and present it for malicious use.
The Koadic Trojan relies on JavaScrpt and VBScript technology that is executed on the host computer. Given this characteristic there are several possibilities that malicious users might consider.
One of them is the use of fake sites — they typically use social engineering tricks by taking the web elements of famous companies or services and implementing them in the pages. A similar method is to send out bulk email messages. A common form is the disguise software update or a notification. The body contents may include scripts or contain links to external resources that lead to the Koadic Trojan infection.
Criminal use of it can come through infected payloads. The first type is the creation of macro-infected documents — they can be of any popular type (presentations, rich text files, spreadsheets) and they utilize a basic premise. Whenever they are opened by the victim users a notification prompt will appear asking them to enable the built-in scripts. If this is done the virus infection will follow.
The other type of infected payload that is generally considered as an adequate weapon is the creation of malicious application installers. They are made by taking the legitimate setup files from the official vendor sites and bundling them with the associated virus code. Such programs are usually applications considered top choices by most end users — creativity suites, system utilities or productivity applications.
Koadic Trojan – In-Depth Analysis
The Koadic Trojan contains an unique characteristic which is its script-based approach. Hackers can change the code on the fly as the infections are ongoing. This is especially important as it can greatly increase the number of infected hosts.
The client side of the Koadic Trojan uses Windows executable files that download the JavaScript or VBScript instance from remote servers. They acquire the intermediate payload, it is configured to take over control of the target machine. It loads an instance that is controlled by the server software used to command the infected hosts.
Once this step is complete the criminals can directly execute arbitrary commands. There are four available options in the current Koadic Trojan captured samples:
- CMD — Allows the operators to run specific commands on the infected computers.
- OUTPUT — Retrieves the output contents from the infected computer.
- DIRECTORY — Sets the writeable directory for the output.
- ZOMBIE — Sets the zombie target.
Once a zombie has been hooked the Koadic Trojan will elevate the UAC security system. This step allows the commands to be run with administrative privileges. When this step is complete the next step would be to initiate a stealth protection component. This is an important step in the process if infection as it scans the system for any software that can interfere with the correct Trojan execution — anti-virus programs, sandbox/debug environments or virtual machine hosts. The associated real-time engines can be disabled and the applications entirely removed.
Once this is done the Koadic Trojan can proceed with the information harvesting step. It can dump the SAM (Security Account Manager) which is the database file used by the Windows operating system that stores all user passwords. The associated SECURITY storage is also accessed.
The network infiltration feature scans the local network for any open SMB ports. This is the service that allows for file and printers sharing. If any open and accessible shares have been identified then the virus will be transferred over to the other machines.
The server instance itself is written in Python — one of the most popular scripting languages used to program such instances.
Koadic Trojan – Trojan Operations
By using plugins called implants the criminals can initiate additional Trojan activity. One of them allows the hackers to hijack the current clipboard and monitor all user input and output.
A fully-featured remote desktop surveillance can be enabled using this modular functionality. Using it the hackers can survey the users at any given time and overtake control of their machines. Data extraction is also made possible by an implant, allowing the hackers to download any file of interest. Upload is possible which is often used to deploy other threats to the infected hosts.
One of the interesting features that the implants provide is the ability to manipulate the users into entering their credentials into pop-up boxes that are generated using native user interface elements. There are two other phishing related ones — the hackers can play a generated message using a text-to-speech interface and another ones which runs a predefined prank. It will max the volume of the audio interface and open “Zombie” by the Cranberries in a hidden window.
Martin Beltov
Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.
Follow Me:
- Guide 1: How to Remove Koadic Trojan from Windows.
- Guide 2: Get rid of Koadic Trojan from Mac OS X.
- Guide 3: Remove Koadic Trojan from Google Chrome.
- Guide 4: Erase Koadic Trojan from Mozilla Firefox.
- Guide 5: Uninstall Koadic Trojan from Microsoft Edge.
- Guide 6: Remove Koadic Trojan from Safari.
- Guide 7: Eliminate Koadic Trojan from Internet Explorer.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
How to Remove Koadic Trojan from Windows.
Step 1: Boot Your PC In Safe Mode to isolate and remove Koadic Trojan
Step 2: Uninstall Koadic Trojan and related software from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:
Follow the instructions above and you will successfully uninstall most programs.Step 3: Clean any registries, created by Koadic Trojan on your computer.
The usually targeted registries of Windows machines are the following:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
You can access them by opening the Windows registry editor and deleting any values, created by Koadic Trojan there. This can happen by following the steps underneath:
Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.Before starting "Step 4", please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Get rid of Koadic Trojan from Mac OS X.
Step 1: Uninstall Koadic Trojan and remove related files and objects
1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove Koadic Trojan via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
You can repeat the same procedure with the following other Library directories:
→ ~/Library/LaunchAgents
/Library/LaunchDaemons
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove malware from your Mac
When you are facing problems on your Mac as a result of unwanted scripts, programs and malware, the recommended way of eliminating the threat is by using an anti-malware program. Combo Cleaner offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Remove Koadic Trojan from Google Chrome.
Step 1: Start Google Chrome and open the drop menu
Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"
Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.
Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Erase Koadic Trojan from Mozilla Firefox.
Step 1: Start Mozilla Firefox. Open the menu window
Step 2: Select the "Add-ons" icon from the menu.
Step 3: Select the unwanted extension and click "Remove"
Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Uninstall Koadic Trojan from Microsoft Edge.
Step 1: Start Edge browser.
Step 2: Open the drop menu by clicking on the icon at the top right corner.
Step 3: From the drop menu select "Extensions".
Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.
Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Remove Koadic Trojan from Safari.
Step 1: Start the Safari app.
Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.
Step 3: From the menu, click on "Preferences".
Step 4: After that, select the 'Extensions' Tab.
Step 5: Click once on the extension you want to remove.
Step 6: Click 'Uninstall'.
A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the Koadic Trojan will be removed.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Eliminate Koadic Trojan from Internet Explorer.
Step 1: Start Internet Explorer.
Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'
Step 3: In the 'Manage Add-ons' window.
Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.
Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.
