Koadic Trojan Removal — Restore Your PC From Infections

The Koadic Trojan is a dangerous Python-based RAT that can cause serious damage to infected hosts. It consists of a modular engine and plugins that add to its functionality. Read our in-depth article to learn more about it.

Threat Summary

Name	Koadic Trojan
Type	Trojan, Ransomware, Cryptocurrency Miner
Short Description	The Koadic Trojan is capable of spying on the users and their machines and harvest sensitive data from it.
Symptoms	Depending on the case the users may experience unusual performance issues.
Distribution Method	Spam Emails, Email Attachments
Detection Tool	See If Your System Has Been Affected by Koadic Trojan Download Malware Removal Tool
User Experience	Join Our Forum to Discuss Koadic Trojan.
Data Recovery Tool	Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Koadic Trojan – Distribution Methods

The Koadic Trojan is a platform that was first presented at the Defcon security conference by its developers — Sean Dillon and Zach Harding. By itself it is not created by hackers or appears in the underground hacker communities supported by them.

This means that the main delivery method is probably to acquire a sample copy of Koadic and present it for malicious use.

The Koadic Trojan relies on JavaScrpt and VBScript technology that is executed on the host computer. Given this characteristic there are several possibilities that malicious users might consider.

One of them is the use of fake sites — they typically use social engineering tricks by taking the web elements of famous companies or services and implementing them in the pages. A similar method is to send out bulk email messages. A common form is the disguise software update or a notification. The body contents may include scripts or contain links to external resources that lead to the Koadic Trojan infection.

Criminal use of it can come through infected payloads. The first type is the creation of macro-infected documents — they can be of any popular type (presentations, rich text files, spreadsheets) and they utilize a basic premise. Whenever they are opened by the victim users a notification prompt will appear asking them to enable the built-in scripts. If this is done the virus infection will follow.

The other type of infected payload that is generally considered as an adequate weapon is the creation of malicious application installers. They are made by taking the legitimate setup files from the official vendor sites and bundling them with the associated virus code. Such programs are usually applications considered top choices by most end users — creativity suites, system utilities or productivity applications.

Koadic Trojan – In-Depth Analysis

The Koadic Trojan contains an unique characteristic which is its script-based approach. Hackers can change the code on the fly as the infections are ongoing. This is especially important as it can greatly increase the number of infected hosts.

The client side of the Koadic Trojan uses Windows executable files that download the JavaScript or VBScript instance from remote servers. They acquire the intermediate payload, it is configured to take over control of the target machine. It loads an instance that is controlled by the server software used to command the infected hosts.

Once this step is complete the criminals can directly execute arbitrary commands. There are four available options in the current Koadic Trojan captured samples:

• CMD — Allows the operators to run specific commands on the infected computers.
• OUTPUT — Retrieves the output contents from the infected computer.
• DIRECTORY — Sets the writeable directory for the output.
• ZOMBIE — Sets the zombie target.

Once a zombie has been hooked the Koadic Trojan will elevate the UAC security system. This step allows the commands to be run with administrative privileges. When this step is complete the next step would be to initiate a stealth protection component. This is an important step in the process if infection as it scans the system for any software that can interfere with the correct Trojan execution — anti-virus programs, sandbox/debug environments or virtual machine hosts. The associated real-time engines can be disabled and the applications entirely removed.

Once this is done the Koadic Trojan can proceed with the information harvesting step. It can dump the SAM (Security Account Manager) which is the database file used by the Windows operating system that stores all user passwords. The associated SECURITY storage is also accessed.

The network infiltration feature scans the local network for any open SMB ports. This is the service that allows for file and printers sharing. If any open and accessible shares have been identified then the virus will be transferred over to the other machines.

The server instance itself is written in Python — one of the most popular scripting languages used to program such instances.

Koadic Trojan – Trojan Operations

By using plugins called implants the criminals can initiate additional Trojan activity. One of them allows the hackers to hijack the current clipboard and monitor all user input and output.

A fully-featured remote desktop surveillance can be enabled using this modular functionality. Using it the hackers can survey the users at any given time and overtake control of their machines. Data extraction is also made possible by an implant, allowing the hackers to download any file of interest. Upload is possible which is often used to deploy other threats to the infected hosts.

One of the interesting features that the implants provide is the ability to manipulate the users into entering their credentials into pop-up boxes that are generated using native user interface elements. There are two other phishing related ones — the hackers can play a generated message using a text-to-speech interface and another ones which runs a predefined prank. It will max the volume of the audio interface and open “Zombie” by the Cranberries in a hidden window.

Manually delete Koadic Trojan from your computer

Note! Substantial notification about the Koadic Trojan threat: Manual removal of Koadic Trojan requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Koadic Trojan files and objects

Boot Your PC Into Safe Mode

1. For Windows XP, Vista and 7. 2. For Windows 8, 8.1 and 10. Fix registry entries created by Koadic Trojan on your PC.

For Windows XP, Vista and 7 systems:

1. Remove all CDs and DVDs, and then Restart your PC from the “Start” menu.
2. Select one of the two options provided below:

– For PCs with a single operating system: Press “F8” repeatedly after the first boot screen shows up during the restart of your computer. In case the Windows logo appears on the screen, you have to repeat the same task again.

– For PCs with multiple operating systems: Тhe arrow keys will help you select the operating system you prefer to start in Safe Mode. Press “F8” just as described for a single operating system.

3. As the “Advanced Boot Options” screen appears, select the Safe Mode option you want using the arrow keys. As you make your selection, press “Enter“.

4. Log on to your computer using your administrator account

While your computer is in Safe Mode, the words “Safe Mode” will appear in all four corners of your screen.

Step 1: Open up the Start Menu.

Step 2: Click on the Power button (for Windows 8 it is the little arrow next to the “Shut Down” button) and whilst holding down “Shift” click on Restart.

Step 3: After reboot, a blue menu with options will appear. From them you should choose Troubleshoot.

Step 4: You will see the Troubleshoot menu. From this menu choose Advanced Options.

Step 5: After the Advanced Options menu appears, click on Startup Settings.

Step 6: From the Startup Settings menu, click on Restart.

Step 7: A menu will appear upon reboot. You can choose any of the three Safe Mode options by pressing its corresponding number and the machine will restart.

Some malicious scripts may modify the registry entries of your computer to change different settings. This is why manual clean up of your Windows Registry Database is strongly recommended. Since the tutorial on how to do this is a bit lenghty, we recommend following our instructive article about fixing registry entries.

2. Find malicious files created by Koadic Trojan on your PC

Find malicious files created by Koadic Trojan

1. For Windows 8, 8.1 and 10. 2. For Windows XP, Vista, and 7.

For Newer Windows Operating Systems

Step 1:

On your keyboard press  + R and write explorer.exe in the Run text box and then click on the Ok button.

Step 2:

Click on your PC from the quick access bar. This is usually an icon with a monitor and its name is either “My Computer”, “My PC” or “This PC” or whatever you have named it.

Step 3:

Navigate to the search box in the top-right of your PC’s screen and type “fileextension:” and after which type the file extension. If you are looking for malicious executables, an example may be “fileextension:exe”. After doing that, leave a space and type the file name you believe the malware has created. Here is how it may appear if your file has been found:

N.B. We recommend to wait for the green loading bar in the navination box to fill up in case the PC is looking for the file and hasn’t found it yet.

For Older Windows Operating Systems

In older Windows OS’s the conventional approach should be the effective one:

Step 1:

Click on the Start Menu icon (usually on your bottom-left) and then choose the Search preference.

Step 2:

After the search window appears, choose More Advanced Options from the search assistant box. Another way is by clicking on All Files and Folders.

Step 3:

After that type the name of the file you are looking for and click on the Search button. This might take some time after which results will appear. If you have found the malicious file, you may copy or open its location by right-clicking on it.

Now you should be able to discover any file on Windows as long as it is on your hard drive and is not concealed via special software.

Automatically remove Koadic Trojan by downloading an advanced anti-malware program

1. Remove Koadic Trojan with SpyHunter Anti-Malware Tool and back up your data

Remove Koadic Trojan with SpyHunter Anti-Malware Tool

1. Install SpyHunter to scan for and remove Koadic Trojan.2. Scan with SpyHunter to Detect and Remove Koadic Trojan. Back up your data to secure it against infections and file encryption by Koadic Trojan in the future.

Step 1: Click on the “Download” button to proceed to SpyHunter’s download page.

Download

Malware Removal Tool

It is highly recommended to run a scan before purchasing the full version of the software to make sure that the current version of the malware can be detected by SpyHunter.

Step 2: Guide yourself by the download instructions provided for each browser.

Step 3: After you have installed SpyHunter, wait for it to update automatically.

Step 1: After the update process has finished, click on the ‘Malware/PC Scan’ tab first and from the window that apears click on ‘Start Scan’.

Step 2: After SpyHunter has finished scanning your PC for any Koadic Trojan files, you can remove them automatically and permanently by clicking on the ‘Next’ button.

Step 3: Once the intrusions have been removed, it is highly recommended to restart your PC.

Back up your data to secure it against attacks in the future

IMPORTANT! Before reading the Windows backup instructions, we highly recommend to back up your data automatically with cloud backup and insure it against any type of data loss on your device, even the most severe. We recommend reading more about and downloading SOS Online Backup .

SOS Online Backup

Optional: Using Alternative Anti-Malware Tools

Remove Koadic Trojan Using Other Alternative Tools

STOPZilla Anti Malware

1. Download and Install STOPZilla Anti-malware to Scan for And Remove Koadic Trojan.
Step 1: Download STOPZilla by clicking here.
Step 2: A pop-up window will appear. Click on the ‘Save File’ button. If it does not, click on the Download button and save it afterwards.

Step 3: After you have downloaded the setup, simply open it.
Step 4: The installer should appear. Click on the ‘Next’ button.

Step 5: Check the ‘I accept the agreement’ check circle if not checked if you accept it and click the ‘Next’ button once again.

Step 6: Review and click on the ‘Install’ button.

Step 7: After the installation process has completed click on the ‘Finish’ button.

2. Scan your PC with STOPZilla Anti Malware to remove all Koadic Trojan associated files completely.
Step 1: Launch STOPZilla if you haven’t launched it after install.
Step 2: Wait for the software to automatically scan and then click on the ‘Repair Now’ button. If it does not scan automatically, click on the ‘Scan Now’ button.

Step 3: After the removal of all threats and associated objects, you should Restart your PC.

Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

More Posts

Follow Me: