ESET MirrorFace DEC 2022

LODEINFO can append C2 communication with randomly generated junk data.

LODEINFO can upload files from infected hosts to the C2.

LODEINFO can run `net view` and `net view /domain` for network discovery.

LODEINFO can exfiltrate collected credentials and browser cookies to the C2 server.

LODEINFO can inject shellcode into the memory of compromised hosts.

LODEINFO can capture keystrokes on targeted systems.

MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.

MirrorFace has used the the PuTTY suite Secure Copy Protocol (SCP) client for file transfer.

LODEINFO has collected stolen web cookies locally in the `%TEMP%` folder.

MirrorStealer has stored stolen credentials on the local machine in `%TEMP%\31558.txt`.

LODEINFO has the ability to designate specific files and folders to encryption.

MirrorFace has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.

LODEINFO has the ability to download additional files from the C2.

LODEINFO has the ability to take screenshots.

MirrorFace has exfiltrated stored emails from compromised hosts.

MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.

LODEINFO has been executed via victims opening malicious email attachments.

LODEINFO can incorporate a ransom command to encrypt specified files and folders.

LODEINFO can list the contents of `%LocalAppData%\Google\Chrome\User Data\` and `%LocalAppData%\Microsoft\Edge\User Data\` to obtain cookies.

LODEINFO has used Registry run keys to set persistence.

MirrorFace has abused a known Microsoft digital signature verification issues to append encrypted data to digital signatures that still appear to be validly signed.

MirrorStealer has the ability to steal credentials from email clients.

MirrorStealer can steal credentials stored in browsers.

MirrorFace has used a tool named MRSAStealer as a password filter to collect credentials on password changes.

MirrorFace has used rar.exe and the Makecab utility to archive files of interest prior to exfiltration.

LODEINFO has been distributed to targeted victims via malicious email attachments.

MirrorFace has sent spearphishing emails with malicious attachments to deliver malware payloads.

MirrorFace has used legitimate EXE files to load malicious DLLs via sideloading.

MirrorFace has created and continued to develop custom strains of malware including LODEINFO.

MirrorFace has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.

MirrorFace has placed specific content in phishing emails to target members of particular political parties.

MirrorFace has sent targeted emails purporting to be from a Japanese political party’s PR department.