Loading malware…
LazarShell is a Windows malware family associated with the Lazarus Group and classified in antivirus detections as a downloader and trojan. It was identified among malware used in 2022 campaigns against South Korean companies and institutions, including defense organizations, with related activity targeting the chemical sector. The associated campaigns used watering-hole attacks through compromised South Korean websites and exploited vulnerable INITECH INISAFE CrossWEB EX software to deliver malware. The broader intrusion chains also involved exploitation of DreamSecurity MagicLine4NX, lateral movement, persistent backdoors, and vulnerable-driver abuse to disable security software; these behaviors are not established as capabilities of LazarShell itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
MagicLine4NX 1.0.0.17 이하의 버전에서는 CVE-2021-26606 취약점이 존재한다. 해당 취약점은 버퍼 오버플로우 취약점으로 원격에서 임의의 명령어를 전송하여 악성코드 감염 등의 피해를 유발할 수 있다. | [파일 진단] Downloader/Win.LazarShell (2022.05.04.02)
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware file-detection list includes “Downloader/Win.LazarShell (2022.05.04.02).”
1 distinct technique documented for this family, organized by ATT&CK tactic.
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Downloader identified as part of the malware used by Lazarus. Its specific capabilities and position in the infection chain are not detailed.
Lazarus-associated downloader/shell component observed in the campaign.
Named Lazarus-associated malware/tool referenced in detection names among related IOCs.
A named Lazarus-associated malware strain appearing in AhnLab's IOC list, classified in the content as both downloader and trojan detections.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.