McAfee Lazarus Resurfaces Feb 2018

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.

Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Various Lazarus Group malware enumerates logged-on users.

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.

A Lazarus Group malware sample performs reflective DLL injection.

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.

Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.

Lazarus Group has conducted C2 over HTTP and HTTPS.

Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.

A Lazarus Group malware sample encodes data with base64.

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.

Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.

Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.

A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.

A Destover-like variant used by Lazarus Group collects disk space information and sends it to its C2 server.