Procedure examples

LODEINFO can append C2 communication with randomly generated junk data.

LODEINFO can upload files from infected hosts to the C2.

LODEINFO can enumerate the MAC address of the compromised host.

LODEINFO can run `net view` and `net view /domain` for network discovery.

LODEINFO has used control flow flattening to obfuscate code.

LODEINFO can use a hashing algorithm to dynamically resolve API function addresses.

The LODEINFO loader module contains XOR-encrypted shellcode.

LODEINFO components have been compressed with zip for delivery.

LODEINFO has inserted junk code to obstruct code analysis.

LODEINFO can identify the associated username on targeted machines.

LODEINFO can exfiltrate collected credentials and browser cookies to the C2 server.

LODEINFO can execute commands with WMI.

LODEINFO can inject shellcode into the memory of compromised hosts.

LODEINFO can capture keystrokes on targeted systems.

LODEINFO can kill a process using specific process ID.

LODEINFO can delete files to remove traces of activity from victim systems.

LODEINFO has collected stolen web cookies locally in the `%TEMP%` folder.

LODEINFO can disover machine information including OS architecture, the ANSI code page (ACP) identifier, and hostname.

LODEINFO has the ability to designate specific files and folders to encryption.

LODEINFO has the ability to download additional files from the C2.

LODEINFO can use Windows APIs such as `VirtualAllocEx()`, `WriteProcessMemory()`, `CreateRemoteThread()`, `NtAllocateVirtualMemory()`, `NtWriteVirtualMemory()`, and `RtlCreateUserThread()` to enable memory injection of shellcode.

LODEINFO has the ability to take screenshots.

LODEINFO can capture system time to send to the C2.

LODEINFO has been executed via victims opening malicious email attachments.

LODEINFO can halt execution if the “en_US” locale is identified on a victim's machine.

LODEINFO can incorporate a ransom command to encrypt specified files and folders.

LODEINFO can list the contents of `%LocalAppData%\Google\Chrome\User Data\` and `%LocalAppData%\Microsoft\Edge\User Data\` to obtain cookies.

LODEINFO has used Registry run keys to set persistence.

LODEINFO has been distributed to targeted victims via malicious email attachments.

LODEINFO can encrypt C2 communication with a hardcoded (NV4HDOeOVyL) Vigenere cipher key.

LODEINFO can use legitimate EXE files to sideload malicious DLLs.

LODEINFO can looks for the “en_US” locale on the victim’s machine.