Trend Micro Earth Kasha Anel NOV 2024

UPPERCUT can upload files to the C2 from infected machines.

During Operation AkaiRyū, MirrorFace used Arp and `dir` for discovery in compromised environments.

ANELLDR code implements anti-analysis techniques including control flow flattening and Mixed Boolean Arithmetic (MBA).

ROAMINGHOUSE can embed a ZIP file containing UPPERCUT components into three base64 encoded parts.

ANELLDR can update its encryption key to AES-256-CBC and re-encrypt its payload, overwriting the original payload file with the newly encrypted data.

ANELLDR can use junk code for payload obfuscation.

During Operation AkaiRyū, MirrorFace disguised LNK and SFX (self-extracting) files as Word documents to lure victims into opening malicious files.

ROAMINGHOUSE can use WMI to launch a legitimate executable later used to enable DLL sideloading.

During Operation AkaiRyū, MirrorFace used PowerShell in execution chains to drop additional files such as embedded CAB files.

UPPERCUT has used HTTP for C2, including sending error codes in cookie headers.

UPPERCUT has the capability to gather the system’s hostname and OS version.

During Operation AkaiRyū, MirrorFace collected system information.

During Operation AkaiRyū, MirrorFace enumerated file system details in compromised environments.

ANELLDR can enumerate files in the current directory to search for encrypted payload files.

UPPERCUT can download and upload files to and from the victim’s machine.

ANELLDR can use the `ZwSetInformationThread` to enable debugger evasion.

UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.

UPPERCUT can base64 encode C2 communications.

ROAMINGHOUSE has been loaded as a Word Template file when victims opened a decoy document placed in `%APPDATA%\Microsoft\Templates` alongside a ROAMINGHOUSE macro.

ANELLDR can decrypt encrypted payload data using AES-256-CBC and subsequently execute the payload in memory.

During Operation AkaiRyū, MirrorFace lured users into executing malicious payloads with links to resources hosted on OneDrive.

During Operation AkaiRyū, MirrorFace used malicious files to drop ROAMINGHOUSE.

ROAMINGHOUSE can check for specific mouse movements and user activity before initiating malicious activity.

UPPERCUT contains functionality to bypass UAC.

During Operation AkaiRyū, MirrorFace distributed crafted spearphishing emails containing malicious attachments.

During Operation AkaiRyū, MirrorFace sent spearphishing emails with malicious OneDrive links.

Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address. UPPERCUT has also used custom ChaCha20, XOR, and LZO algorithms for C2 communication.

ANELLDR can use DLL sideloading from a legitimate application to initiate execution.

ROAMINGHOUSE can use a legitimate EXE to sideload a malicious DLL named JSFC.dll. ROAMINGHOUSE has also used ScnCfg32.exe to sideload vsodscpl.dll to enable UPPERCUT execution.

During Operation AkaiRyū, MirrorFace used free email providers such as Gmail for spearphishing.

During Operation AkaiRyū, MirrorFace used compromised accounts to send spearphishing emails.

During Operation AkaiRyū, MirrorFace used links to direct victims to malicious files hosted on OneDrive.

ANELLDR can call `ZwSetInformationThread` with the second argument set to `ThreadHideFromDebugger (0x11)` to evade being debugged.

UPPERCUT can use a sleep function to delay execution.