LO$R Logger v2

Cyberattacks have evolved significantly, leveraging advanced tools to exploit vulnerabilities and steal sensitive data. One such tool, often referred to as “LO$R Logger v2,” has gained notoriety for its effectiveness in credential theft and surveillance. This malware variant is commonly distributed through phishing campaigns, malicious downloads, or exploit kits, targeting both individuals and organizations. Once deployed, it operates stealthily, exfiltrating valuable information such as login credentials, keystrokes, and system details, making it a persistent threat in modern cybercrime.

The software is a type of information-stealing malware designed to harvest sensitive data from infected systems. Threat actors typically use it for financial gain, espionage, or to compromise a network further. Capable of bypassing basic security measures, it logs user activity, captures screenshots, and extracts credentials stored in browsers or other applications. Its modular design allows for customization, enabling attackers to tailor its functionality based on their objectives.

Key Features of LO$R Logger v2

Feature	Description
Credential Harvesting	Extracts saved passwords from browsers, email clients, and FTP applications.
Keylogging	Records keystrokes to capture login credentials and other typed input.
Screen Capture	Takes periodic screenshots to monitor user activity.
Data Exfiltration	Sends stolen data to a remote server via encrypted channels.
Persistence	Maintains long-term access by modifying registry keys or creating scheduled tasks.
Anti-Detection	Uses obfuscation and evasion techniques to avoid signature-based detection.

How LO$R Logger v2 Works

The malware employs a multi-stage execution process to infiltrate, persist, and exfiltrate data while evading detection. Below is a breakdown of its operation:

1. Delivery and Infection

The initial infection typically occurs through:

Phishing Emails: Malicious attachments or links that download and execute the payload.
Drive-by Downloads: Exploiting vulnerabilities in browsers or plugins to silently install the malware.
Trojanized Software: Bundling the malware with legitimate-looking applications.

Once executed, the malware may inject itself into a trusted system process to avoid suspicion.

2. Persistence Mechanisms of LO$R Logger v2

To ensure it remains active after reboots, the malware may:

Create registry run keys
Set up scheduled tasks to relaunch at intervals.
Modify system files or deploy a secondary payload for redundancy.

3. Data Collection Techniques

The malware uses several methods to gather information:

Browser Hijacking: Scrapes credentials, cookies, and autofill data from browsers like Chrome, Firefox, and Edge.
Keylogging: Monitors keyboard input to capture passwords, messages, and other sensitive input.
Memory Scraping: Extracts credentials from processes, including password managers and authentication tokens.
Screen Recording: Periodically captures screens to track user activity.

4. Exfiltration and Command & Control (C2)

Stolen data is compressed, encrypted, and transmitted to a remote C2 server using protocols like HTTP(S) or FTP. Some variants utilize domain generation algorithms (DGAs) to switch C2 servers, making takedowns more challenging in a dynamic manner.