BLOCKBUSTED: Lazarus Blockbuster and North Korea
Contents
As we have proven in previous research blog posts, malware authors often reuse the same code. This evolution of code and code reuse is seen all throughout the well known Blockbuster campaign and connections between other malware attributed to the Lazarus group, a cyber threat organization attributed to North Korea. You can read about excellent research on Lazarus and the Blockbuster campaign by looking at reports by Novetta, Kaspersky, and Palo Alto.
The Lazarus group has been responsible for different campaigns and variations of RATs, Trojans, backdoors, and malware in general. Some of the names given to malware created by Lazarus are FALLCHILL, Destover, Hangman, Volgmer, and Manuscrypt, among others. For someone who has not personally analyzed these different malware families, a lot of the samples associated with each malware could appear to be completely different, but if you examine them at the code level, you can see that these attacks …
The Lazarus group has been responsible for different campaigns and variations of RATs, Trojans, backdoors, and malware in general. Some of the names given to malware created by Lazarus are FALLCHILL, Destover, Hangman, Volgmer, and Manuscrypt, among others. For someone who has not personally analyzed these different malware families, a lot of the samples associated with each malware could appear to be completely different, but if you examine them at the code level, you can see that these attacks …
IoC
0b4959764331ddbe7da71e6f8515d0be8f494b4107c2718bda9e0a85d8247488
114.215.107.218
118.140.97.6
14.161.14.196
16eaa0298c66e0de40cc42568879fab9513f4d533c0fa1f5366346b4d70df50d
176.35.250.93
182.180.143.39
190.216.219.247
193.251.27.90
1d195c40169cbdb0f50eca40ebda62321aa05a54137635c7ebb2960690eb1d82
201.26.209.137
220.132.191.110
2de5e99315a6cf42a46c8286ac4ea0bc842f6d78995833d2cab7de1cdad7dd8d
3d481d166f27b48f103db39fda3845dfc962addd44e92e3187e0ddd1ee01c741
41.131.29.59
4481e31d42499d084317b79a3a6250e50302aa00603dacdd2dff3a8e3b911404
4a84452752cf8e493ae820871096044edd9f6453366842927148e7d8e218dc87
4e8c10a7fa51a3ab089b284e86a7daaca779ed82ba1750607fc3bfa91681f9b1
58.6.21.11
64.86.34.24
6dcd635875625426298a1d7b4ab346ee318b3afa2e6440677ab935e473bf782d
7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd
76e0eec565f4e50b57d74fb1a09ea9e356da0709cba3d5dab9b3702ba19d662c
80b5cc9feb10fac41ee2958ab0f751bf807126e34dcb5435d2869ef1cf7abc41
8ba791b9611d5d6dfd40e08e43ad851675faea24c2f5bc4f541e475871999ad3
8edb59694ff239c90f33cdbb17bc67ebbd08ec77df5000c6616d7844040796b4
92.42.54.184
959eb014a2d8ca8158d1f6a198205d331e0ebfb3ced5fd9004b8dcab4547987f
9607ab45451bb6c52eeec8cf0669d1dd37c917baecef2d63564c7cec110932c0
9f177a6fb4ea5af876ef8a0bf954e37544917d9aaba04680a29303f24ca5c72c
9fa326adbd71e58aeb7ea404b6b8d6be5742c547c525286b2e95444ab099ef9e
a4a2e47161bbf5f6c1d5b1b3fba26a19dbfcdcf4eb575b56bde05c674089ae95
a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6
db1f4abd2a8d3b17c14e8f31cb1da3a273cf51ed194ad0e4520346ed95708dad
dbae68e4cab678f2678da7c48d579868e35100f3596bf3fa792ee000c952c0ed
de13155f4a4cb1af04539883545151905ad4496ea6ef34cb22e50831f7caa38a
e79bbb45421320be05211a94ed507430cc9f6cf80d607d61a317af255733fcf2
ee3ecf100fc2042cfadeb0509ae4f49647daa1afcee2bd3098912247e155a1e7
f09fb9a79bab6a927297e536594027016da7d7ab13e124c76a05889ec107ad02
http://lzruziniu.com
http://www.israeldefense.co.il/he/comment/112488
114.215.107.218
118.140.97.6
14.161.14.196
16eaa0298c66e0de40cc42568879fab9513f4d533c0fa1f5366346b4d70df50d
176.35.250.93
182.180.143.39
190.216.219.247
193.251.27.90
1d195c40169cbdb0f50eca40ebda62321aa05a54137635c7ebb2960690eb1d82
201.26.209.137
220.132.191.110
2de5e99315a6cf42a46c8286ac4ea0bc842f6d78995833d2cab7de1cdad7dd8d
3d481d166f27b48f103db39fda3845dfc962addd44e92e3187e0ddd1ee01c741
41.131.29.59
4481e31d42499d084317b79a3a6250e50302aa00603dacdd2dff3a8e3b911404
4a84452752cf8e493ae820871096044edd9f6453366842927148e7d8e218dc87
4e8c10a7fa51a3ab089b284e86a7daaca779ed82ba1750607fc3bfa91681f9b1
58.6.21.11
64.86.34.24
6dcd635875625426298a1d7b4ab346ee318b3afa2e6440677ab935e473bf782d
7429a6b6e8518a1ec1d1c37a8786359885f2fd4abde560adaef331ca9deaeefd
76e0eec565f4e50b57d74fb1a09ea9e356da0709cba3d5dab9b3702ba19d662c
80b5cc9feb10fac41ee2958ab0f751bf807126e34dcb5435d2869ef1cf7abc41
8ba791b9611d5d6dfd40e08e43ad851675faea24c2f5bc4f541e475871999ad3
8edb59694ff239c90f33cdbb17bc67ebbd08ec77df5000c6616d7844040796b4
92.42.54.184
959eb014a2d8ca8158d1f6a198205d331e0ebfb3ced5fd9004b8dcab4547987f
9607ab45451bb6c52eeec8cf0669d1dd37c917baecef2d63564c7cec110932c0
9f177a6fb4ea5af876ef8a0bf954e37544917d9aaba04680a29303f24ca5c72c
9fa326adbd71e58aeb7ea404b6b8d6be5742c547c525286b2e95444ab099ef9e
a4a2e47161bbf5f6c1d5b1b3fba26a19dbfcdcf4eb575b56bde05c674089ae95
a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6
db1f4abd2a8d3b17c14e8f31cb1da3a273cf51ed194ad0e4520346ed95708dad
dbae68e4cab678f2678da7c48d579868e35100f3596bf3fa792ee000c952c0ed
de13155f4a4cb1af04539883545151905ad4496ea6ef34cb22e50831f7caa38a
e79bbb45421320be05211a94ed507430cc9f6cf80d607d61a317af255733fcf2
ee3ecf100fc2042cfadeb0509ae4f49647daa1afcee2bd3098912247e155a1e7
f09fb9a79bab6a927297e536594027016da7d7ab13e124c76a05889ec107ad02
http://lzruziniu.com
http://www.israeldefense.co.il/he/comment/112488