Loading malware…
IndiaIndia is a Lazarus Group malware family used for host reconnaissance, victim profiling, local data staging, and exfiltration to command-and-control infrastructure. Observed functionality includes collecting network interface configuration details such as IP addressing, gateways, subnet mask, DHCP data, and WINS availability; enumerating running processes to capture associated window titles; and querying Windows Registry locations under both HKCU and HKLM to determine whether selected applications are installed, including remote administration and file transfer software. The malware saves gathered victim information locally in a temporary directory, then compresses and encrypts the collected data before uploading it to one of multiple command-and-control servers over its existing C2 channel. IndiaIndia is associated with Lazarus Group tradecraft and fits the group’s broader espionage-oriented operational pattern of system discovery, environment awareness, staged collection, and covert exfiltration on compromised Windows hosts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Obtains and exfiltrates first NIC configuration details including IP, gateway, subnet mask, DHCP, and WINS availability.
Malware that saves victim information to a file and uploads it to one of multiple C2 servers.
Malware that collects and exfiltrates detailed network interface configuration including IP, gateway, subnet mask, DHCP, and WINS availability.
Lazarus-associated malware that gathers victim information and uploads it to C2 servers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.