Lotoor

Overview

Exploit:AndroidOS/Lotoor (often referred to simply as Lotoor) is a specific classification for a family of **Android Rooting Exploits**. Unlike traditional malware that runs within the confines of the Android sandbox, Lotoor's sole objective is to actively exploit vulnerabilities in the Linux kernel underlying the Android OS to escalate its privileges to `root` (superuser). Once root access is achieved, the malware can bypass all Android security models to install persistent backdoors or aggressive adware.

Understanding Android Rooting Malware
To an end-user, the infection vector is usually a deceptive app downloaded from a third-party marketplace. For a Mobile Device Management (MDM) administrator, Lotoor represents a complete device compromise. By achieving root, the malware can install itself in the `/system` partition, meaning it survives factory resets, rendering standard removal techniques useless.

Execution and Exploitation Mechanics
Lotoor is typically bundled inside Trojanized applications disguised as games or utilities (`T1444`). Upon installation and execution (`T1627`), it profiles the device's specific Android version, kernel build, and hardware architecture (`T1426`). It then selects and deploys a specific privilege escalation exploit tailored to that environment (historically, exploits like 'Towelroot' or 'Framaroot') (`T1404`). If successful, it mounts the read-only `/system` partition as read-write, drops an `su` binary, and installs its secondary payload (often a persistent backdoor or un-removable adware) directly into the system directories (`T1543`).

Indicators of Compromise & Impact
The primary impact is the complete compromise of the mobile device's integrity and the potential theft of corporate data if the device is used for BYOD. MDM logs will flag the device as 'Rooted' or 'Compromised'. The user may notice the sudden appearance of new, uninstallable applications (bloatware) or highly aggressive, full-screen advertisements appearing even when the browser is closed. The device may also become highly unstable and prone to crashing due to the kernel exploitation.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_LOTOOR {
    meta:
        description = "Detects Lotoor (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "lotoor" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Lotoor Activity
id: f51c5c4ed291d935c1e7fb163283cdcd
status: experimental
description: Detects generic indicators of the lotoor malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*lotoor*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use the corporate MDM (Mobile Device Management) solution to immediately quarantine the device, wiping all corporate data and cutting VPN/email access.
2. A standard Android 'Factory Reset' via the settings menu is often insufficient to remove Lotoor, as it resides in the `/system` partition.
3. The device must be completely 'flashed' with a clean, factory-verified ROM image from the manufacturer to ensure the malware is eradicated.
4. Enforce MDM policies that strictly prohibit the installation of applications from 'Unknown Sources' (third-party app stores).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the device to connect to the corporate network once it has been flagged as rooted.
2. Avoid assuming an antivirus app from the Google Play Store can remove it; AV apps do not have the root privileges necessary to clean the `/system` partition.

References & External Analysis

• Search "lotoor" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Vitro
• Seznam
• Remexi
• Travnet
• Mansabo

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/lotoor.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.