TrendMicro macOS Dacls May 2020

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Dacls can encrypt its configuration file with AES CBC.

Dacls can collect data on running and parent processes.

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.

Dacls can use HTTPS in C2 communications.

Lazarus Group has conducted C2 over HTTP and HTTPS.

Dacls can scan directories on a compromised host.

Lazarus Group has used multiple proxies to obfuscate network traffic from victims.

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

Dacls can download its payload from a C2 server.

Dacls can establish persistence via a LaunchAgent.

Dacls can establish persistence via a Launch Daemon.

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.

Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.