Qualys LolZarus

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.

Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.

Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.

Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.

Lazarus Group has conducted C2 over HTTP and HTTPS.

Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.

Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.

Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.

Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.

Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.