Trend Micro Earth Kasha Updates APR 2025

UPPERCUT can upload files to the C2 from infected machines.

ROAMINGHOUSE can use WMI to launch a legitimate executable later used to enable DLL sideloading.

MirrorFace has used `cmd.exe` for malware execution, file discovery, and manual file manipulation.

MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.

UPPERCUT can download and upload files to and from the victim’s machine.

UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.

ROAMINGHOUSE can decode and drop a malicious ZIP file prior to execution.

ROAMINGHOUSE has been executed through luring victims into clicking links to download malicious ZIP files.

MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.

ROAMINGHOUSE can change its execution method to create a batch file in the startup folder that executes a legitimate executable if a McAfee product is detected.

ROAMINGHOUSE can identify McAfee applications on compromised hosts and change its execution method if one is detected.

UPPERCUT contains functionality to bypass UAC.

MirrorFace has embedded OneDrive URLs in emails leading to malicious file installation.

ROAMINGHOUSE has been distributed through phishing emails containing malicious OneDrive links.

HiddenFace has used dynamic domain generation algorithms in C2.

HiddenFace can hide its IP lookup by using DNS over HTTPS (DoH) for C2.

Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address. UPPERCUT has also used custom ChaCha20, XOR, and LZO algorithms for C2 communication.

ROAMINGHOUSE can use a legitimate EXE to sideload a malicious DLL named JSFC.dll. ROAMINGHOUSE has also used ScnCfg32.exe to sideload vsodscpl.dll to enable UPPERCUT execution.

UPPERCUT can use a sleep function to delay execution.