Kaspersky LODEINFO OCT 2022

LODEINFO can enumerate the MAC address of the compromised host.

DOWNIISSA code is base64 encoded and XOR encrypted.

The LODEINFO loader module contains XOR-encrypted shellcode.

LODEINFO components have been compressed with zip for delivery.

DOWNIISSA can inject shellcode directly into process memory including WINWORD.exe and msiexec.exe.

DOWNIISSA can delete files after download.

DOWNIISSA can download files to the compromised host.

DOWNIISSA can use the `URLDownloadToFileA()` API to download from remote resources.

DOWNIISSA can decode strings prior to execution.

MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.

LODEINFO has been executed via victims opening malicious email attachments.

DOWNIISSA can create an instance of msiexec.exe and inject LODEINFO shellcode into the memory of the process.

LODEINFO has been distributed to targeted victims via malicious email attachments.

MirrorFace has sent spearphishing emails with malicious attachments to deliver malware payloads.

LODEINFO can use legitimate EXE files to sideload malicious DLLs.

MirrorFace has used legitimate EXE files to load malicious DLLs via sideloading.