Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Our initial analysis of malware disclosed in the BadCyber blog hinted at the involvement of the 'Lazarus' threat actor... The filename srservice.chm is consistent with the method in which a known Lazarus toolkit module constructs CHM and HLP file names... It's worth noting that both parts of the shellcode load the APIs similarly to all other tools from the Lazarus toolset.
1 distinct technique documented for this family, organized by ATT&CK tactic.
213 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named in the article as an example of malware using reflective DLL injection.
North Korean APT group known for cyber-espionage, financial theft, and disruptive attacks, targeting a wide range of industries globally.
A Lazarus-linked malware/toolset used in watering-hole attacks against Polish financial institutions. Components include encrypted CHM/HLP payloads, DLL/EXE loaders that decrypt and inject payloads into processes such as lsass.exe and explorer.exe, a bot/backdoor with custom encrypted C2 over SSL/TLS, and a multi-stage SWF-based exploit delivery chain. The tooling uses transliterated Russian words as a likely false-flag attribution decoy.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.