NOOPLDR

Malware & Tools · NOOPLDR

· MalwareS9025 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

NOOPLDR is a shellcode loader with XML/C# and DLL versions that has been used by MirrorFace to load HiddenFace.(Citation: Trend Micro Earth Kasha NOV 2024)

Tactic Coverage

stealth (9)execution (3)privilege escalation (1)discovery (1)defense impairment (1)persistence (1)

Used By (1 groups)

G1054MirrorFaceEarth Kasha

Techniques (12)

T1027Obfuscated Files or Information

stealth

T1027.013Encrypted/Encoded File

stealth

T1027.016Junk Code Insertion

stealth

T1055Process Injection

stealthprivilege escalation

T1070.004File Deletion

stealth

T1082System Information Discovery

discovery

T1106

References

https://attack.mitre.org/software/S9025 https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html