DOWNIISSA

Malware & Tools · DOWNIISSA

· MalwareS9021 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

DOWNIISSA is a shellcode downloader that has been used by MirrorFace since at least 2022 to deploy payloads, including the LODEINFO backdoor.(Citation: Kaspersky LODEINFO OCT 2022)

Tactic Coverage

stealth (5)privilege escalation (1)command and control (1)execution (1)

Used By (1 groups)

G1054MirrorFaceEarth Kasha

Techniques (7)

T1027.013Encrypted/Encoded File

stealth

T1055Process Injection

stealthprivilege escalation

T1070.004File Deletion

stealth

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1140Deobfuscate/Decode Files or Information

stealth

References

https://attack.mitre.org/software/S9021 https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/