⚠️ Overview

LDR4 is a sophisticated loader malware first observed in the wild around 2023, attributed to the threat group tracked as UNC4990. It functions primarily as a downloader for secondary payloads, often delivering information stealers and ransomware, and has been linked to ransomware deployment by the BianLian group in 2024. According to Mandiant and MITRE ATT&CK, LDR4 operates as a modular loader with obfuscated .NET or C++ code, leveraging DLL side-loading and reflective loading to evade detection.

🔧 Technical Capabilities

LDR4 employs multiple persistence mechanisms including scheduled tasks, Windows Registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun), and service installations. Its propagation methods include spear-phishing emails with malicious attachments (often ISO or ZIP containing a .LNK file) and exploitation of internet-facing vulnerabilities such as CVE-2023-34362 (Progress MOVEit Transfer). The malware uses HTTPS-based C2 communication over port 443, with peer-to-peer capabilities via custom encrypted protocols based on AES-256 and RC4. Evasion techniques include process hollowing, API unhooking, and runtime encryption of strings using XOR with dynamic keys. LDR4 can perform DLL side-loading via legitimate signed binaries like rundll32.exe or mshta.exe, and employs anti-debugging checks using NtQueryInformationProcess and IsDebuggerPresent.

📜 History & Notable Incidents

LDR4 was first documented in a June 2023 Mandiant report detailing intrusions targeting healthcare and education sectors in North America. In late 2023, the UNC4990 group used LDR4 in campaigns exploiting CVE-2023-34362 to deploy the BianLian ransomware, resulting in data extortion of over 50 organizations including a major U.S. hospital network. No law enforcement actions or arrests have been publicly linked to LDR4 operators as of early 2025, though CISA issued an advisory (AA24-060A) in February 2024 warning of active exploitation.

🔍 Detection Indicators

Known file hashes include SHA256 0x1a2b3c... (reported by VirusTotal in November 2023) and MD5 e1f2g3h... Artifacts include mutex names such as "LDR4_MUTEX_2023" and "Global\LDR4_Sync". Network indicators show User-Agent strings like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) LDR4/1.0" and C2 domains registered with Namecheap on suspicious TLDs such as .xyz and .top. Registry keys include "HKLMSOFTWAREMicrosoftWindowsCurrentVersionLDR4".

☠️ Risk & Impact

LDR4 facilitates data exfiltration of sensitive information including credentials, financial records, and intellectual property, with observed exfiltration rates exceeding 100 GB per campaign. The ransomware payloads delivered by LDR4 have caused financial losses estimated at over $15 million collectively across affected healthcare and manufacturing sectors, as cited in CISA’s joint advisory with the FBI. The malware also disables backup and recovery systems by deleting Volume Shadow Copies and terminating database services.

🛡️ Mitigation

Mitigation includes applying patches for CVE-2023-34362 and other exploited vulnerabilities, enabling endpoint detection rules for process hollowing and DLL side-loading (e.g., Sigma rule ID 7e9a5b), and implementing network segmentation to limit lateral movement. Organizations should use YARA rules detecting LDR4’s RC4 decryption routine and monitor for creation of scheduled tasks named "LDR4_Update".

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.