The Koadic Trojan is a dangerous Python-based RAT that can cause serious damage to infected hosts. It consists of a modular engine and plugins that add to its functionality. Read our in-depth article to learn more about it.
|Type||Trojan, Ransomware, Cryptocurrency Miner|
|Short Description||The Koadic Trojan is capable of spying on the users and their machines and harvest sensitive data from it.|
|Symptoms||Depending on the case the users may experience unusual performance issues.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by Koadic Trojan |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Koadic Trojan.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Koadic Trojan – Distribution Methods
The Koadic Trojan is a platform that was first presented at the Defcon security conference by its developers — Sean Dillon and Zach Harding. By itself it is not created by hackers or appears in the underground hacker communities supported by them.
This means that the main delivery method is probably to acquire a sample copy of Koadic and present it for malicious use.
The Koadic Trojan relies on JavaScrpt and VBScript technology that is executed on the host computer. Given this characteristic there are several possibilities that malicious users might consider.
One of them is the use of fake sites — they typically use social engineering tricks by taking the web elements of famous companies or services and implementing them in the pages. A similar method is to send out bulk email messages. A common form is the disguise software update or a notification. The body contents may include scripts or contain links to external resources that lead to the Koadic Trojan infection.
Criminal use of it can come through infected payloads. The first type is the creation of macro-infected documents — they can be of any popular type (presentations, rich text files, spreadsheets) and they utilize a basic premise. Whenever they are opened by the victim users a notification prompt will appear asking them to enable the built-in scripts. If this is done the virus infection will follow.
The other type of infected payload that is generally considered as an adequate weapon is the creation of malicious application installers. They are made by taking the legitimate setup files from the official vendor sites and bundling them with the associated virus code. Such programs are usually applications considered top choices by most end users — creativity suites, system utilities or productivity applications.
Koadic Trojan – In-Depth Analysis
The Koadic Trojan contains an unique characteristic which is its script-based approach. Hackers can change the code on the fly as the infections are ongoing. This is especially important as it can greatly increase the number of infected hosts.
Once this step is complete the criminals can directly execute arbitrary commands. There are four available options in the current Koadic Trojan captured samples:
- CMD — Allows the operators to run specific commands on the infected computers.
- OUTPUT — Retrieves the output contents from the infected computer.
- DIRECTORY — Sets the writeable directory for the output.
- ZOMBIE — Sets the zombie target.
Once a zombie has been hooked the Koadic Trojan will elevate the UAC security system. This step allows the commands to be run with administrative privileges. When this step is complete the next step would be to initiate a stealth protection component. This is an important step in the process if infection as it scans the system for any software that can interfere with the correct Trojan execution — anti-virus programs, sandbox/debug environments or virtual machine hosts. The associated real-time engines can be disabled and the applications entirely removed.
Once this is done the Koadic Trojan can proceed with the information harvesting step. It can dump the SAM (Security Account Manager) which is the database file used by the Windows operating system that stores all user passwords. The associated SECURITY storage is also accessed.
The network infiltration feature scans the local network for any open SMB ports. This is the service that allows for file and printers sharing. If any open and accessible shares have been identified then the virus will be transferred over to the other machines.
The server instance itself is written in Python — one of the most popular scripting languages used to program such instances.
Koadic Trojan – Trojan Operations
By using plugins called implants the criminals can initiate additional Trojan activity. One of them allows the hackers to hijack the current clipboard and monitor all user input and output.
A fully-featured remote desktop surveillance can be enabled using this modular functionality. Using it the hackers can survey the users at any given time and overtake control of their machines. Data extraction is also made possible by an implant, allowing the hackers to download any file of interest. Upload is possible which is often used to deploy other threats to the infected hosts.
One of the interesting features that the implants provide is the ability to manipulate the users into entering their credentials into pop-up boxes that are generated using native user interface elements. There are two other phishing related ones — the hackers can play a generated message using a text-to-speech interface and another ones which runs a predefined prank. It will max the volume of the audio interface and open “Zombie” by the Cranberries in a hidden window.