ITOCHU LODEINFO JAN 2024

LODEINFO can upload files from infected hosts to the C2.

LODEINFO has used control flow flattening to obfuscate code.

The LODEINFO loader module contains XOR-encrypted shellcode.

MirrorFace has used Base64 encoded shellcode in infection chains to evade detection.

LODEINFO has inserted junk code to obstruct code analysis.

LODEINFO can identify the associated username on targeted machines.

MirrorFace has crafted malware payloads to appear as Privacy-Enhanced Mail (PEM) files.

LODEINFO can execute commands with WMI.

LODEINFO can inject shellcode into the memory of compromised hosts.

LODEINFO can capture keystrokes on targeted systems.

LODEINFO can kill a process using specific process ID.

MirrorFace has used remote templates with VBA code in malware infection chains.

LODEINFO can delete files to remove traces of activity from victim systems.

LODEINFO can disover machine information including OS architecture, the ANSI code page (ACP) identifier, and hostname.

MirrorFace has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.

LODEINFO has the ability to designate specific files and folders to encryption.

LODEINFO has the ability to download additional files from the C2.

LODEINFO has the ability to take screenshots.

MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.

LODEINFO has been executed via victims opening malicious email attachments.

MirrorFace has used remote template injection to retrieve malicious payloads from the C2.

LODEINFO can incorporate a ransom command to encrypt specified files and folders.

MirrorFace has sent spearphishing emails with malicious attachments to deliver malware payloads.

LODEINFO has been distributed to targeted victims via malicious email attachments.

MirrorFace has used legitimate EXE files to load malicious DLLs via sideloading.

MirrorFace has deployed shellcode to check for Japanese Microsoft Office settings.