McAfee Lazarus Nov 2020

Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.

Torisma has been packed with Iz4 compression.

During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.

Torisma has been Base64 encoded and AES encrypted.

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.

Torisma can send victim data to an actor-controlled C2 server.

Torisma can use `WTSEnumerateSessionsW` to monitor remote desktop connections.

Torisma can use HTTP and HTTPS for C2 communications.

Torisma has used various Windows API calls.

Torisma can collect the current time on a victim machine.

Torisma has encoded C2 communications with Base64.

Torisma has used XOR and Base64 to decode C2 data.

Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.

Torisma has encrypted its C2 communications using XOR and VEST-32.

For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.

For Operation Dream Job, Lazarus Group used compromised servers to host malware.

Torisma can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can also use `GetDriveType` to determine if a new drive is a CD-ROM drive.