ClearSky Lazarus Aug 2020

During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.

DRATzarus can collect information from a compromised host.

DRATzarus can search for other machines connected to compromised host and attempt to map the network.

DRATzarus can be partly encrypted with XOR.

DRATzarus's dropper can be packed with UPX.

During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.

DRATzarus can obtain a list of users from an infected machine.

DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.

During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.

DRATzarus can enumerate and examine running processes to determine if a debugger is present.

During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.

DRATzarus can use HTTP or HTTPS for C2 communications.

During Operation Dream Job, Lazarus Group conducted word searches within documents on a compromised host in search of security and financial matters.

During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.

DRATzarus can deploy additional tools onto an infected machine.

DRATzarus can use various API calls to see if it is running in a sandbox.

DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.

During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.

During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.

During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`.

During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.

During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services.

DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to measure function timing. DRATzarus can also remotely shut down into sleep mode under specific conditions to evade
detection.

During Operation Dream Job, Lazarus Group used tools that collected `GetTickCount` and `GetSystemTimeAsFileTime` data to detect sandbox or VMware services.

During Operation Dream Job, Lazarus Group conducted internal spearphishing from within a compromised organization.

During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.

During Operation Dream Job, Lazarus Group sent malicious OneDrive links with fictitious job offer advertisements via email.

During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.

During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.

During Operation Dream Job, Lazarus Group used file hosting services like DropBox and OneDrive.

For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.

For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.

For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.

For Operation Dream Job, Lazarus Group conducted extensive reconnaissance research on potential targets.

For Operation Dream Job, Lazarus Group gathered victim organization information to identify specific targets.

During Operation Dream Job, Lazarus Group targeted specific individuals within an organization with tailored job vacancy announcements.

For Operation Dream Job, Lazarus Group used compromised servers to host malware.

During Operation Dream Job, Lazarus Group deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.

DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.

During Operation Dream Job, Lazarus Group used tools that used the `IsDebuggerPresent` call to detect debuggers.

During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.