ROAMINGHOUSE

Malware & Tools · ROAMINGHOUSE

· MalwareS9026 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

ROAMINGHOUSE is a dropper malware used by MirrorFace to extract and execute embedded payloads including UPPERCUT components.(Citation: Trend Micro Earth Kasha Updates APR 2025)

Tactic Coverage

stealth (5)execution (4)discovery (2)persistence (1)initial access (1)

Used By (1 groups)

G1054MirrorFaceEarth Kasha

Techniques (11)

T1027.013Encrypted/Encoded File

stealth

T1047Windows Management Instrumentation

execution

T1137.001Office Template Macros

persistence

T1140Deobfuscate/Decode Files or Information

stealth

T1204.001Malicious Link

execution

T1204.002Malicious File

execution

T1480Execution Guardrails

References

https://attack.mitre.org/software/S9026 https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html