Lotoor

Overview

Exploit:AndroidOS/Lotoor (often referred to simply as Lotoor) is a specific classification for a family of **Android Rooting Exploits**. Unlike traditional malware that runs within the confines of the Android sandbox, Lotoor's sole objective is to actively exploit vulnerabilities in the Linux kernel underlying the Android OS to escalate its privileges to `root` (superuser). Once root access is achieved, the malware can bypass all Android security models to install persistent backdoors or aggressive adware.

Understanding Android Rooting Malware
To an end-user, the infection vector is usually a deceptive app downloaded from a third-party marketplace. For a Mobile Device Management (MDM) administrator, Lotoor represents a complete device compromise. By achieving root, the malware can install itself in the `/system` partition, meaning it survives factory resets, rendering standard removal techniques useless.

Execution and Exploitation Mechanics
Lotoor is typically bundled inside Trojanized applications disguised as games or utilities (`T1444`). Upon installation and execution (`T1627`), it profiles the device's specific Android version, kernel build, and hardware architecture (`T1426`). It then selects and deploys a specific privilege escalation exploit tailored to that environment (historically, exploits like 'Towelroot' or 'Framaroot') (`T1404`). If successful, it mounts the read-only `/system` partition as read-write, drops an `su` binary, and installs its secondary payload (often a persistent backdoor or un-removable adware) directly into the system directories (`T1543`).

Indicators of Compromise & Impact
The primary impact is the complete compromise of the mobile device's integrity and the potential theft of corporate data if the device is used for BYOD. MDM logs will flag the device as 'Rooted' or 'Compromised'. The user may notice the sudden appearance of new, uninstallable applications (bloatware) or highly aggressive, full-screen advertisements appearing even when the browser is closed. The device may also become highly unstable and prone to crashing due to the kernel exploitation.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_LOTOOR_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lotoor"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "lotoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Lotoor (Trojan) Execution & Triage
id: fae86cb8-16d0-5a26-8d6a-06d04c961afc
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Lotoor malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/lotoor
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1444
- attack.t1404
- attack.t1543
- attack.t1426
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_LOTOOR_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lotoor tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "lotoor" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use the corporate MDM (Mobile Device Management) solution to immediately quarantine the device, wiping all corporate data and cutting VPN/email access.
2. A standard Android 'Factory Reset' via the settings menu is often insufficient to remove Lotoor, as it resides in the `/system` partition.
3. The device must be completely 'flashed' with a clean, factory-verified ROM image from the manufacturer to ensure the malware is eradicated.
4. Enforce MDM policies that strictly prohibit the installation of applications from 'Unknown Sources' (third-party app stores).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the device to connect to the corporate network once it has been flagged as rooted.
2. Avoid assuming an antivirus app from the Google Play Store can remove it; AV apps do not have the root privileges necessary to clean the `/system` partition.

References & External Analysis

• CISA Advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-1823
• Search "lotoor" on VirusTotal (External Analysis)
• Search "lotoor" on Any.Run (Sandbox Sandbox)
• Search "lotoor" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2011-1823 ↗

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Luhn
• Bandok
• Tasker
• Delfinject
• Genericrxce
• Seed
• Bitter
• Defaulttab

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/lotoor.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.