Rewterz Threat Alert – Lazarus Group – Indicators of Compromise

Analysis Summary

APT group Lazarus continues to target the financial world with their enhanced techniques and tools and are currently active supplying malware. The group uses customized PowerShell scripts on Windows systems. These scripts connect to the command and control infrastructure and await commands. The scripts disguise themselves with names that appear to be WordPress files or other open-source-based file names.

Impact

Malware infection

Indicators of Compromise

IP(s)/ Hostname(s)

• http[.]//115[.]28[.]160[.]20[.]443 
• http[.]//bluecreekrobotics[.]com/wp-includes/common[.]php 
• http[.]//dev[.]microcravate[.]com/wp-includes/common[.]php 
• http[.]//dev[.]whatsyourcrunch[.]com/wp-includes/common[.]php 
• http[.]//enterpriseheroes[.]com[.]ng/wp-includes/common[.]php 
• http[.]//hrgp[.]asselsolutions[.]com/wp-includes/common[.]php 
• http[.]//nzssdm[.]com/assets/mt[.]dat 
• http[.]//nzssdm[.]com/assets/wwtm[.]dat 
• https[.]//baseballcharlemagnelegardeur[.]com/wp-content/languages/common[.]php 
• https[.]//bogorcenter[.]com/wp-content/themes/index2[.]php 
• https[.]//eventum[.]cwsdev3[.]bi[.]com/wp-includes/common[.]php 
• https[.]//streamf[.]ru/wp-content/index2[.]php 
• https[.]//towingoperations[.]com/chat/chat[.]php 
• https[.]//vinhsake[.]com//wp-content/uploads/index2[.]php 
• https[.]//www[.]tangowithcolette[.]com/pages/common[.]php 
• nzssdm[.]com

Malware Hash (MD5/SHA1/SH256)

• 0316f6067bc02c23c1975d83c659da21 
• 171b9135540f89bf727b690b9e587a4e 
• 29a37c6d9fae5664946c6607f351a8dc 
• 35e38d023b253c0cd9bd3e16afc362a7 
• 4345798b2a09fc782901e176bd0c69b6 
• 4cbd45fe6d65f513447beb4509a9ae3d 
• 5182e7a2037717f2f9bbf6ba298c48fb 
• 668d5b5761755c9d061da74cb21a8b75 
• 6a0f3abd05bc75edbfb862739865a4cc 
• 72fe869aa394ef0a62bb8324857770dd 
• 86d3c1b354ce696e454c42d8dc6df1b7 
• Da4981df65cc8b5263594bb71a0720a1 
• F392492ef5ea1b399b4c0af38810b0d6 
• a18bc8bc82bca8245838274907e64631 
• ad3f966d48f18b5e7b23a579a926c7e8 
• cb713385655e9af0a2fc10da5c0256f5 
• e6d5363091e63e35490ad2d76b72e851 
• e9a6a945803722be1556fd120ee81199

Remediation

• Block threat indicators at respective controls 
• Always be aware of the suspicious emails sent by unknown senders 
  
• Never click on the link/attachments sent by unknown senders