Indicators of Compromise | lazarus.day

IoCs

223 IoCs

Type	Value	First Seen	Last Seen
YARA	LazarusCampaign_MacroDoc_Jun2021	2021-07-06	2021-07-06
YARA	HvS_APT37_webshell_controllers_…	2020-12-15	2020-12-15
YARA	HvS_APT37_mimikatz_loader_DF012	2020-12-15	2020-12-15
YARA	HvS_APT37_webshell_img_thumbs_a…	2020-12-15	2020-12-15
YARA	HvS_APT37_RAT_loader	2020-12-15	2020-12-15
YARA	HvS_APT37_cred_tool	2020-12-15	2020-12-15
YARA	HvS_APT37_smb_scanner	2020-12-15	2020-12-15
YARA	HighExpert_HWP_HSIProp	2020-11-16	2020-11-16
YARA	CISA_3P_10301706_01	2020-08-26	2020-08-26
YARA	CISA_3P_10257062	2020-08-26	2020-08-26
YARA	CISA_10257062_01	2020-08-26	2020-08-26
YARA	CISA_3P_10301706_02	2020-08-26	2020-08-26
YARA	CISA_10295134_01	2020-08-19	2020-08-19
YARA	CISA_10135536_06	2020-08-19	2020-08-19
YARA	lazarus_network_backdoor_unpack…	2020-08-18	2020-08-18

LazarusCampaign_MacroDoc_Jun2021

YARA

First seen: 2021-07-06 • Last seen: 2021-07-06

HvS_APT37_webshell_controllers_asp

YARA

First seen: 2020-12-15 • Last seen: 2020-12-15

HvS_APT37_mimikatz_loader_DF012

YARA

First seen: 2020-12-15 • Last seen: 2020-12-15

HvS_APT37_webshell_img_thumbs_asp

YARA

First seen: 2020-12-15 • Last seen: 2020-12-15

HvS_APT37_RAT_loader

YARA

First seen: 2020-12-15 • Last seen: 2020-12-15

HvS_APT37_cred_tool

YARA

First seen: 2020-12-15 • Last seen: 2020-12-15

HvS_APT37_smb_scanner

YARA

First seen: 2020-12-15 • Last seen: 2020-12-15

HighExpert_HWP_HSIProp

YARA

First seen: 2020-11-16 • Last seen: 2020-11-16

CISA_3P_10301706_01

YARA

First seen: 2020-08-26 • Last seen: 2020-08-26

CISA_3P_10257062

YARA

First seen: 2020-08-26 • Last seen: 2020-08-26

CISA_10257062_01

YARA

First seen: 2020-08-26 • Last seen: 2020-08-26

CISA_3P_10301706_02

YARA

First seen: 2020-08-26 • Last seen: 2020-08-26

CISA_10295134_01

YARA

First seen: 2020-08-19 • Last seen: 2020-08-19

CISA_10135536_06

YARA

First seen: 2020-08-19 • Last seen: 2020-08-19

lazarus_network_backdoor_unpacked

YARA

First seen: 2020-08-18 • Last seen: 2020-08-18

LazarusCampaign_MacroDoc_Jun2021

YARA

First seen: Jul 2021

Last seen: Jul 2021

HvS_APT37_webshell_controllers_asp

YARA

First seen: Dec 2020

Last seen: Dec 2020

HvS_APT37_mimikatz_loader_DF012

YARA

First seen: Dec 2020

Last seen: Dec 2020

HvS_APT37_webshell_img_thumbs_asp

YARA

First seen: Dec 2020

Last seen: Dec 2020

HvS_APT37_RAT_loader

YARA

First seen: Dec 2020

Last seen: Dec 2020

HvS_APT37_cred_tool

YARA

First seen: Dec 2020

Last seen: Dec 2020

HvS_APT37_smb_scanner

YARA

First seen: Dec 2020

Last seen: Dec 2020

HighExpert_HWP_HSIProp

YARA

First seen: Nov 2020

Last seen: Nov 2020

CISA_3P_10301706_01

YARA

First seen: Aug 2020

Last seen: Aug 2020

CISA_3P_10257062

YARA

First seen: Aug 2020

Last seen: Aug 2020

CISA_10257062_01

YARA

First seen: Aug 2020

Last seen: Aug 2020

CISA_3P_10301706_02

YARA

First seen: Aug 2020

Last seen: Aug 2020

CISA_10295134_01

YARA

First seen: Aug 2020

Last seen: Aug 2020

CISA_10135536_06

YARA

First seen: Aug 2020

Last seen: Aug 2020

lazarus_network_backdoor_unpacked

YARA

First seen: Aug 2020

Last seen: Aug 2020

1
«
9
10
11
12
13
»
15

⚠ These IoCs were automatically extracted using regular expressions or an LLM and may include non-malicious data.