Novetta Blockbuster Destructive Malware

Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.

Various Lazarus Group malware enumerates logged-on users.

Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.

Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.

Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.

Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.

Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.

Several Lazarus Group malware families install themselves as new services.

RawDisk has been used to directly access the hard disk to help overwrite arbitrarily sized portions of disk content.

Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.

Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.

A Destover-like variant used by Lazarus Group collects disk space information and sends it to its C2 server.