H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[NOOPLDR](https://attack.mitre.org/software/S9025) is a shellcode loader with XML/C# and DLL versions that has been used by [MirrorFace](https://attack.mitre.org/groups/G1054) to load [HiddenFace](https://attack.mitre.org/software/S9023).(Citation: Trend Micro Earth Kasha NOV 2024)

Labels

malware

13 recorded

Relationships

uses

from MirrorFace

Group

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Hide Artifacts

Technique

uses

to Junk Code Insertion

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Injection

Technique

uses

to System Information Discovery

Technique

2 external

References

mitre-attack

S9025

Trend Micro Earth Kasha NOV 2024

https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html