Procedure examples

Lizar can run Mimikatz to harvest credentials.

Lizar has retrieved network information from a compromised host, such as the MAC address.

Lizar has obfuscated the fingerprint of the victim system, the local IP address, and the Fowler-Noll-V 1 (FNV-1) hash of the local IP address using an XOR operation. The data is then sent to the C2 server.

Lizar can collect the username from the system.

Lizar has a plugin to retrieve information about all active network sessions on the infected server.

Lizar can migrate the loader into another process.

Lizar has used the PowerKatz plugin that can be loaded into the address space of a PowerShell process through reflective DLL loading.

Lizar can execute PE files in the address space of the specified process.

Lizar has a plugin designed to obtain a list of processes.

Lizar has used PowerShell scripts.

Lizar has a command to open the command-line on the infected system.

Lizar has used Python scripts (ps2x.py script and ps2p.py) to execute files on remote hosts using the Impacket library.

Lizar can collect the computer name from the machine.

Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.

Lizar has used a raw TCP connection to communicate with the C2 server.

Lizar can download additional plugins, files, and tools.

Lizar has used various Windows API functions on a victim's machine.

Lizar can take JPEG screenshots of an infected system. Lizar has also used a plugin to take a screenshot of the infected system.

Lizar has used a complex XOR operation to obfuscate C2 communications.

Lizar has decrypted its configuration data, such as the C2 IP address, ports and other network communication.

Lizar can retrieve browser history and database files.

Lizar can search for processes associated with an anti-virus product from list.

Lizar has a module to collect usernames and passwords stored in browsers.

Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.

Lizar has encrypted data before sending it to the server.

Lizar can support encrypted communications between the client and server.

FIN7 has obtained and used tools such as Impacket, Mimikatz, and PsExec.

Lizar has used the Reflective DLL injection module from Github to inject itself into a process’s memory.