MirrorStealer

Malware & Tools · MirrorStealer

· MalwareS9022 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

MirrorStealer is a credential stealer that has been used by MirrorFace since at least 2022 to steal credentials from various applications, including browsers and email clients. MirrorStealer has been delivered directly into system memory via commands issued by LODEINFO.(Citation: ESET MirrorFace DEC 2022)

Tactic Coverage

credential access (3)collection (1)

Used By (1 groups)

G1054MirrorFaceEarth Kasha

Techniques (4)

T1074.001Local Data Staging

collection

T1552.006Group Policy Preferences

credential access

T1555Credentials from Password Stores

credential access

T1555.003Credentials from Web Browsers

credential access

References

https://attack.mitre.org/software/S9022 https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/