Introducing Loda Malware

Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name ‘Loda’ is derived from a directory to which the malware author chose to write keylogger logs (Figure 14). It should be noted that some antivirus products currently detect Loda as “Trojan.Nymeria”, although the connection is not well-documented.

Loda appears to be distributed by multiple cybercrime actors targeting a variety of verticals. We have observed Loda spread via email campaigns containing Microsoft Word attachments with macros (Figure 3), exploits, or packager shell objects (Figure 4). Notably, we found a document that used the recent CVE-2017-0199 exploit (Figure 1). In addition, we have observed Loda distributed via PDF attachments, links, and executable attachments (Figure 2).

While Loda is a threat on its own, we have also seen campaigns where it was used to download additional information-stealing malware, such as the ISR Stealer.

Figure 1: CVE-2017-0199 document used to deliver Loda

Figure 2: Email with an executable attachment delivering Loda

Figure 3: Macro document used to deliver Loda

Figure 4: Document with embedded Packager Object used to deliver Loda

Analysis

We have observed two versions of the malware, 1.0.0 and 1.0.1, in the wild. Both were tagged as beta versions of the software. In both versions, the malware copies itself to a directory in the %TEMP% folder and creates persistence using a scheduled task. This is typically a 6-character task name which references the executable that was copied to %TEMP%. The malware checks in to a command and control (C&C) server and reports the following information:

• Victim’s Country
• A hard coded string (seen ‘victim’, ‘Clientv4’)
• Victim’s IP address
• User account name
• Windows version
• Windows architecture (X64 or X86)
• Webcam installed (Yes or No, enumerated using capGetDriverDescription from Avicap32.dll)
• Installed AV Vendor (enumerated via running process names)
• Malware version, i.e. 1.0.1
• Hard coded string (seen ‘ddd’)
• Monitor resolution in a special format (“Pr[Height]X2[Width]X3”)
• OS type (can be “laptop”, “Desktop”, or “x”, enumerated using the WMI query "Select * from Win32_SystemEnclosure")
• Version (beta)

Figure 5: Information sent by the victim machine to the C&C server

Since Loda is written in AutoIt, the executable is trivial to decompile. The author of the malware took slight measures to combat this and has obfuscated the AutoIt source code using several generic techniques. The most notable example is the use of string obfuscation on most variables. Strings are hex-encoded and concatenated into a larger string with a separator value that appears to be unique in each sample. At run time, variables are initialized based on parsing the large string into an array that is created based on the separator value. Finally, each variable is initialized based on the index of the array that the string is in.

Figure 6: Deobfuscated (left) vs obfuscated (right) strings with random variable names

Figure 7: A snippet of variable initialization code from the large array of encoded strings (typically 2000+ elements)

Loda accepts a wide range of commands from the C&C with the following functionality:

• Send a file to C&C
• Receive text from C&C and write to file (likely for batch files)
• Receive data from C&C and write as binary (executable) and run it (Figure 12)
• Execute a hidden Windows Media Player streaming from an arabic radio MMS (Figure 11)
• Close windows media player (likely related to above)
• Upload keylogger data (Figure 10)
• Delete keylogger data
• Read text to victim using SAPI.SpVoice (text sent from C&C)
• Get file or directory sizes (path requested from C&C)
• Shutdown victim PC
• Change wallpaper via registry modifications
• Zip/Unzip files (to exfil to C&C or to decompress from C&C)
• Basic ShellExecute command
• Copy file or directory (paths requested from C&C)
• Enumerate attached drives
• Enumerate common folder locations (Desktop/Pictures/Profile/Appdata/Temp)
• Detect UAC settings
• Download and play .wav files from C&C
• Record microphone sounds using Windows Sound Recorder (Figure 9)
• Send mouse clicks (left or right being separate commands)
• Capture screenshot and send to C&C
• Open/Close CD tray
• Download and execute a file (HTTP path specified from C&C)
• Create a GUI Chat window (Victim/Attacker conversation saved to a file; see Figure 8)
• Record Webcam
• Delete Chrome/Firefox cookies (closes browsers to do this)
• Send running process names to C&C
• Close a running process

Figure 8: Ability to create a GUI Chat window from the ‘hacker’ to the victim

Figure 9: Ability to record microphone input using Windows Sound Recorder

Figure 10: Upload and delete keylogger data (implemented as two separate commands, but likely occurring in the same C&C request)

Figure 11: Stream an arabic radio station (shortcut to hidden Windows Media Player MMS)

Figure 12: Receive data from C&C, write to disk and execute

We were able to observe the network traffic associated with these C&C communications, a sample of which is shown in Figure 13.

Figure 13: PCAP of C&C communications, as Loda downloads a payload

Figure 14: Origin of the name “Loda” (keylogger logs are stored in the directory /LODA/Log)

Conclusion

Loda malware is a robust keylogger and remote access Trojan with extensive capabilities for collecting and exfiltrating victim information from infected PCs. Since we first observed it in the wild last fall, its footprint has increased dramatically with multiple threat actors distributing the malware via a range of email vectors. It has appeared in attacks across multiple verticals and been used as both a standalone threat and an intermediate loader. While fairly straightforward to analyze because it was coded in AutoIT, Loda’s capabilities for data collection, system control, direct victim interaction, and flexible C&C communications pose significant risks for victims and organizations with infected PCs.

Indicators of Compromise (IOCs)

ET and ETPRO Suricata/Snort Coverage

2822117 | ETPRO TROJAN Loda Logger CnC Beacon Response
2822116 | ETPRO TROJAN Loda Logger CnC Beacon
2825085 | ETPRO TROJAN Loda Logger Screenshot Request
2825086 | ETPRO TROJAN Loda Logger Module Download Request
2825087 | ETPRO TROJAN Loda Logger Module Execute Request
2825088 | ETPRO TROJAN Loda Logger List Disk Drives Request
2825089 | ETPRO TROJAN Loda Logger List Desktop Files Request
2825090 | ETPRO TROJAN Loda Logger List Disk Drive Files Request