Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
LittleLooter • Masquerades as WhatsApp for Android • Multi-functional backdoor • HTTP/SMS C2 communications
14 distinct techniques documented for this family, organized by ATT&CK tactic.
The stolen data contained photos associated with the victim, contact lists, group memberships and conversations.
Info Stealers & Keyloggers: The group’s toolkit includes browser info stealers and keyloggers.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom Android backdoor with information-stealing capabilities.
Custom Android backdoor used for surveillance and information theft. It communicates with a C2 server over HTTP POST, using GZIP compression, AES encryption, and Base64 encoding, and supports extensive device monitoring and control including recording video/audio, live screen capture, GPS/GSM location gathering, file operations, contact/SMS/call log theft, browser history collection, camera use, and network/Wi-Fi/Bluetooth/mobile data control. It also includes a self-update mechanism that replaces classes.dex from a downloaded update package.
A malicious application delivered via Iranian social engineering engagements; used in attack operations targeting victims across sectors inside and outside Iran.
Android malware masquerading as WhatsApp; a multifunctional backdoor using HTTP and SMS for command-and-control. The sample was discovered by X-Force in October 2020 and uploaded to VirusTotal in December 2020.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.