NOOPLDR

Executive Summary

NOOPLDR is a modular shellcode loader used by MirrorFace to deploy HiddenFace on Windows systems. It supports multiple file formats and leverages XML/C# configuration for stealthy delivery, allowing in‑memory execution and dynamic library loading. Because the loader is lightweight and obfuscated, it can evade traditional static defenses and facilitate rapid deployment of more dangerous payloads. Security teams should monitor for anomalous process creation, unusual DLL injection patterns, and known loader hashes to mitigate risk.

NOOPLDR is a compact shellcode loader primarily designed for Windows environments. It comes in multiple host formats – an executable, an XML/C# wrapper and a standard DLL – allowing adversaries to embed it within legitimate-looking files or inject it directly into memory. Once executed, NOOPLDR parses its configuration (which can be defined in XML, C# assemblies or DLL metadata) to locate the target payload referred to as HiddenFace. Adversaries such as MirrorFace have leveraged NOOPLDR to deliver the more advanced component HiddenFace with reduced footprint and lower detection risk. By decoupling delivery from execution, operators can change the visible file type or use stealthy in‑memory injection, making traditional asset‑side scanning less effective. The loader also supports dynamic linking of additional DLLs at runtime, enabling the chain to evolve without requiring system reboot. Operationally, NOOPLDR allows a multi‑stage infection pipeline: first malware delivers the lightweight loader; subsequently it fetches and runs HiddenFace from either local storage or remote sources using encoded XML directives. This reduces alerting by keeping network traffic encapsulated in HTTPS/SSL or disguised as benign application communication. Defenders should watch for anomalous “shellcode” executables, DLLs containing large blocks of obfuscated data, or process creation patterns that match known MirrorFace artifacts. Detecting the loader’s unique XML payload signatures can provide early warning before the final infection stage is completed.

Key Capabilities

• Loads shellcode or secondary payload from disk or memory
• Parses XML/C# configuration for stealthy delivery
• Supports multiple host formats (EXE, DLL, XML wrapper)
• Performs dynamic linking of additional DLLs at runtime
• Executes payload invisibly via in‑memory injection

ATT&CK Techniques

Recommended Actions

• Block inbound/outbound traffic to known MirrorFace or HiddenFace command & control domains.
• Deploy YARA rules that match NOOPLDR signatures and embedded XML markers.
• Monitor EDR for LoadLibrary, CreateRemoteThread, and suspicious DLL creation events.
• Quarantine any unverified executable or DLL containing large obfuscated payload blocks.
• Maintain up‑to‑date OS patches to limit exploitation via memory corruption bugs.

Suggested Tags