Rewterz Threat Alert – Lazarus Group – Indicators of Compromise

April 4, 2019

Analysis Summary

APT group Lazarus continues to target the financial world with their enhanced techniques and tools and are currently active supplying malware. The group uses customized PowerShell scripts on Windows systems. These scripts connect to the command and control infrastructure and await commands. The scripts disguise themselves with names that appear to be WordPress files or other open-source-based file names.

Impact

Malware infection

Indicators of Compromise

IP(s)/ Hostname(s)

http[.]//115[.]28[.]160[.]20[.]443
http[.]//bluecreekrobotics[.]com/wp-includes/common[.]php
http[.]//dev[.]microcravate[.]com/wp-includes/common[.]php
http[.]//dev[.]whatsyourcrunch[.]com/wp-includes/common[.]php
http[.]//enterpriseheroes[.]com[.]ng/wp-includes/common[.]php
http[.]//hrgp[.]asselsolutions[.]com/wp-includes/common[.]php
http[.]//nzssdm[.]com/assets/mt[.]dat
http[.]//nzssdm[.]com/assets/wwtm[.]dat
https[.]//baseballcharlemagnelegardeur[.]com/wp-content/languages/common[.]php
https[.]//bogorcenter[.]com/wp-content/themes/index2[.]php
https[.]//eventum[.]cwsdev3[.]bi[.]com/wp-includes/common[.]php
https[.]//streamf[.]ru/wp-content/index2[.]php
https[.]//towingoperations[.]com/chat/chat[.]php
https[.]//vinhsake[.]com//wp-content/uploads/index2[.]php
https[.]//www[.]tangowithcolette[.]com/pages/common[.]php
nzssdm[.]com

Malware Hash (MD5/SHA1/SH256)

0316f6067bc02c23c1975d83c659da21
171b9135540f89bf727b690b9e587a4e
29a37c6d9fae5664946c6607f351a8dc
35e38d023b253c0cd9bd3e16afc362a7
4345798b2a09fc782901e176bd0c69b6
4cbd45fe6d65f513447beb4509a9ae3d
5182e7a2037717f2f9bbf6ba298c48fb
668d5b5761755c9d061da74cb21a8b75
6a0f3abd05bc75edbfb862739865a4cc
72fe869aa394ef0a62bb8324857770dd
86d3c1b354ce696e454c42d8dc6df1b7
Da4981df65cc8b5263594bb71a0720a1
F392492ef5ea1b399b4c0af38810b0d6
a18bc8bc82bca8245838274907e64631
ad3f966d48f18b5e7b23a579a926c7e8
cb713385655e9af0a2fc10da5c0256f5
e6d5363091e63e35490ad2d76b72e851
e9a6a945803722be1556fd120ee81199

Remediation

Block threat indicators at respective controls
Always be aware of the suspicious emails sent by unknown senders
Never click on the link/attachments sent by unknown senders