Indicators of Compromise | lazarus.day

IoCs

223 IoCs

Type	Value	First Seen	Last Seen
YARA	NK_APT_AppleSeed_Dropper	2022-06-05	2022-06-05
YARA	Microsoft_Signed_DLL_With_High_…	2022-04-29	2022-04-29
YARA	Red_Lich_Encoded_PlugX	2022-04-29	2022-04-29
YARA	NK_GOLDBACKDOOR_Main	2022-04-21	2022-04-21
YARA	NK_GOLDBACKDOOR_generic_shellco…	2022-04-21	2022-04-21
YARA	NK_GOLDBACKDOOR_injected_shellc…	2022-04-21	2022-04-21
YARA	NK_GOLDBACKDOOR_inital_shellcode	2022-04-21	2022-04-21
YARA	NK_GOLDBACKDOOR_obf_payload	2022-04-21	2022-04-21
YARA	NK_GOLDBACKDOOR_LNK_payload	2022-04-21	2022-04-21
YARA	NK_GOLDBACKDOOR_LNK	2022-04-21	2022-04-21
YARA	UC_ttp_BlackMatter__SafeBoot	2021-11-26	2021-11-26
YARA	UC_ttp_BlackMatter__RegKeys	2021-11-26	2021-11-26
YARA	Scarcruft_RUBY_Shellcode_XOR_Ro…	2021-07-14	2021-07-14
YARA	Scarcruft_Reverse_BS64_Loader	2021-07-14	2021-07-14
YARA	LazarusCampaign_Payload_Jun2021	2021-07-06	2021-07-06

NK_APT_AppleSeed_Dropper

YARA

First seen: 2022-06-05 • Last seen: 2022-06-05

Microsoft_Signed_DLL_With_High_Entropy_Data_After_Digital_Signature

YARA

First seen: 2022-04-29 • Last seen: 2022-04-29

Red_Lich_Encoded_PlugX

YARA

First seen: 2022-04-29 • Last seen: 2022-04-29

NK_GOLDBACKDOOR_Main

YARA

First seen: 2022-04-21 • Last seen: 2022-04-21

NK_GOLDBACKDOOR_generic_shellcode

YARA

First seen: 2022-04-21 • Last seen: 2022-04-21

NK_GOLDBACKDOOR_injected_shellcode

YARA

First seen: 2022-04-21 • Last seen: 2022-04-21

NK_GOLDBACKDOOR_inital_shellcode

YARA

First seen: 2022-04-21 • Last seen: 2022-04-21

NK_GOLDBACKDOOR_obf_payload

YARA

First seen: 2022-04-21 • Last seen: 2022-04-21

NK_GOLDBACKDOOR_LNK_payload

YARA

First seen: 2022-04-21 • Last seen: 2022-04-21

NK_GOLDBACKDOOR_LNK

YARA

First seen: 2022-04-21 • Last seen: 2022-04-21

UC_ttp_BlackMatter__SafeBoot

YARA

First seen: 2021-11-26 • Last seen: 2021-11-26

UC_ttp_BlackMatter__RegKeys

YARA

First seen: 2021-11-26 • Last seen: 2021-11-26

Scarcruft_RUBY_Shellcode_XOR_Routine

YARA

First seen: 2021-07-14 • Last seen: 2021-07-14

Scarcruft_Reverse_BS64_Loader

YARA

First seen: 2021-07-14 • Last seen: 2021-07-14

LazarusCampaign_Payload_Jun2021

YARA

First seen: 2021-07-06 • Last seen: 2021-07-06

NK_APT_AppleSeed_Dropper

YARA

First seen: Jun 2022

Last seen: Jun 2022

Microsoft_Signed_DLL_With_High_Entropy_Data_After_Digital_Signature

YARA

First seen: Apr 2022

Last seen: Apr 2022

Red_Lich_Encoded_PlugX

YARA

First seen: Apr 2022

Last seen: Apr 2022

NK_GOLDBACKDOOR_Main

YARA

First seen: Apr 2022

Last seen: Apr 2022

NK_GOLDBACKDOOR_generic_shellcode

YARA

First seen: Apr 2022

Last seen: Apr 2022

NK_GOLDBACKDOOR_injected_shellcode

YARA

First seen: Apr 2022

Last seen: Apr 2022

NK_GOLDBACKDOOR_inital_shellcode

YARA

First seen: Apr 2022

Last seen: Apr 2022

NK_GOLDBACKDOOR_obf_payload

YARA

First seen: Apr 2022

Last seen: Apr 2022

NK_GOLDBACKDOOR_LNK_payload

YARA

First seen: Apr 2022

Last seen: Apr 2022

NK_GOLDBACKDOOR_LNK

YARA

First seen: Apr 2022

Last seen: Apr 2022

UC_ttp_BlackMatter__SafeBoot

YARA

First seen: Nov 2021

Last seen: Nov 2021

UC_ttp_BlackMatter__RegKeys

YARA

First seen: Nov 2021

Last seen: Nov 2021

Scarcruft_RUBY_Shellcode_XOR_Routine

YARA

First seen: Jul 2021

Last seen: Jul 2021

Scarcruft_Reverse_BS64_Loader

YARA

First seen: Jul 2021

Last seen: Jul 2021

LazarusCampaign_Payload_Jun2021

YARA

First seen: Jul 2021

Last seen: Jul 2021

1
«
8
9
10
11
12
»
15

⚠ These IoCs were automatically extracted using regular expressions or an LLM and may include non-malicious data.