McAfee Lazarus Jul 2020

During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.

During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.

During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.

During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.

During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.

During Operation Dream Job, Lazarus Group uses HTTP and HTTPS to contact actor-controlled C2 servers.

During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.

During Operation Dream Job, Lazarus Group used Windows API `ObtainUserAgentString` to obtain the victim's User-Agent and used the value to connect to their C2 server.

During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.

During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`.

During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.

During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.

During Operation Dream Job, Lazarus Group placed LNK files into the victims' startup folder for persistence.

During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.

During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.

For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.

For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.

For Operation Dream Job, Lazarus Group used compromised servers to host malware.