Lazarus is analyzed as a financially focused APT group with suspected Northeast Asian origins, noted for multi-stage VHD-based attacks that bypass common defenses and target financial institutions and crypto exchanges. The operation includes spearphishing bait, a loader that decrypts a DLL, anti‑security evasion, and C2 retrieval attempts, with ties to past Lazarus activity such as Sony Pictures and Bangladesh Bank incidents. #LazarusGroup #MizuhoBank #SumitomoMitsuiBankingCorporation #SonyPicturesEntertainment #SumitomoMitsui
Keypoints
- The Lazarus group is described as an APT with a history dating back to 2007, shifting focus from government espionage to financial theft and crypto-related targets since 2014.
- A VHD-based attack sample uses Japanese bank recruitment ads (Mizuho Bank) as bait and is delivered via spearphishing attachments.
- The 0x02 component (Job_Description.exe) acts as a loader that copies Dump.bin, decrypts in memory, and loads a DLL for further actions.
- The DLL uses RC4 with a hard-coded key to decrypt configuration data and then loads into memory, calling an exported function to continue operations.
<liA defense-evasion routine includes checking for antivirus processes, creating a mutex, and delaying or altering behavior based on detected security software.
<liThe actors leverage curl to fetch additional payloads and use rundll32 to execute certain stages, illustrating multi-stage C2 and payload delivery.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – Initial access via spearphishing email attachments that lure victims to open the VHD file. “phishing emails with an attachment to entice victims to click and open the VHD file”
- [T1036] Masquerading – File name tricks and icon camouflage to hide executable extension. “Using a lot of spaces in the file name to hide the .exe suffix; using a PDF icon to masquerade.”
- [T1059.005] VBScript – Lazarus commonly uses VBScript/VBA scripts for payloads. “two VB/VBA files; analysis shows Lazarus commonly uses vbs scripts.”
- [T1105] Ingress Tool Transfer – The loader uses curl to fetch payloads and creates pipes for reading. “using curl.exe to obtain subsequent payloads, creating pipes to read data”
- [T1055] DLL Loading/Injection – The decrypted DLL is loaded into memory with LoadLibraryW and an exported function is invoked. “loads the decrypted dll into memory, and calls the export function”
- [T1027] Obfuscated/Encrypted Files and Information – The loaded DLL decrypts using RC4 with a hard-coded key. “RC4 algorithm key is hard-coded in the file”
- [T1497] Virtualization/Sandbox Evasion – The malware checks for antivirus processes and adjusts behavior accordingly. “If specific processes exist, a global variable is set to 1”
- [T1562.001] Impair Defenses – If BitDefender or Windows Defender is present, the malware delays and uses rundll32 to invoke exports. “delay 10 seconds, then create rundll32 to call its export function”
- [T1059.005] VBScript (Additional) – The analysis also references vbs-based scripting used in C2-related files. “two VBScript files linked to C2 data requests”
Indicators of Compromise
- [File Name] context – Job_Description.vhd, Job_Description.exe, Job_Description.pdf, Dump.bin
- [MD5] context – 3CE53609211CAE4C925B9FEE88C7380E, 931D0969654AF3F77FC1DAB9E2BD66B1, 31E154E560DFF21F07F8AFF37BE6DE9B, A17E9FC78706431FFC8B3085380FE29F, 2A7745C1B6FBC60C88487908A1D39EBB, 08C14DD68DA6800A6E630B0E6BEE8F6F, 86B415DBF3BF56A7B03E5625A6139DE7, 3B06B63DF1DFD4FB21E8196E4EF910DC, 234260684F0406A443AB7D7558ECE5B9, 341B2C4D99BEBAF345AB3C3E2A5E892C, A4A33AA68310AFF5CD023658CE11813C, 0A8A4E2D462FB4B56EA98B25D5B1BDB3
- [URL] context – https://azure.protection-service.cloud/GJ4EDAp_dNg/lIHlIP4QM7/GQKGPNuo4R/c5njZjK9Tq/J7rC%2BBrm/ZoQVg%3D%3D, https://docs.azure-protection.cloud/EMPxSKTgrr3/2CKnoSNLFF/0d6rQrBEMv/gGFroIw5_m/n9hLXkEOy3/wyQ%3D%3D, https://azure.protection-service.cloud/7eEznAhLPT/7WfzhdrG_aj2/yKK3eGVlT4w_/SAO4_j71MnZD/IpOkszug%3D%3D
- [URL] context – Additional related C2/download indicators appear across multiple azure-protection.cloud domains and variants (see article for full list)
Read more: https://mp.weixin.qq.com/s/nnLqUBPX8xZ3hCr5u-iSjQ