lazarusholic

Everyday is lazarus.dayβ

Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware

2021-03-23, Sygnia
https://sygnia.co/mata-framework
#MATA #TFlower

Contents

Over the past few years, North Korea has turned its offensive cyber operations into a major source of income. On February 17, 2021, the US Department of Justice (DoJ) has indicted additional three North Korean (DPRK) military Reconnaissance General Bureau (RGB) personnel, with participating in a cyber-attacks that has allegedly included destructive cyber-attacks and the theft and extortion of over USD1.3bn.
The charges filed relate to Lazarus Group’s (also known as Hidden Cobra) long-running cyber apparatus, financial theft and extortion, including multiple extortion schemes, WannaCry malware and the cyber-attack on Sony Pictures. A key technical component associated with Lazarus is the MATA malware framework, an advanced cross-platform malware framework, which was reported by Kaspersky on July 22, 2020, and by Netlab on December 19, 2019.
In a recent double extortion ransomware attack investigated by Sygnia, the threat actor leveraged a new and so far undocumented variant of MATA. This MATA variant was …

IoC

02c646ec8b88dcdc381b3ce1449fd19ee58f4202
03532ad6ed73f731f0380afc1854bdffe2880844
0547a8718765b8e8338dd0ea7a6d943b2f38c232
06dbfb0ba7f155e40d73ece9d8a76e26da210e27
0a25f29bd5d6639057ea5e4548d4629d736a0451
0a3c2caa5332916025311cc7bd8eabd7b8dcb4f6
0b189512af2b498fac0bdce31c386d2b6c55fc97
0d5cab6893e98032518d7faf962197daf4cd00e6
0e32a40bb83fec79614b07ddc4a1d1143be761db
101.99.91.178
101.99.91.247
103.15.28.243
103.15.29.59
103.16.229.232
103.16.229.233
103.214.147.138
103.214.147.139
103.214.147.209
103.214.147.39
103.214.147.40
103.63.2.184
103.63.2.209
103.63.2.211
104.143.36.33
104.143.37.54
104.143.37.55
104.143.37.87
104.168.148.216
104.168.62.33
104.200.67.160
104.217.163.61
104.219.237.202
104.219.237.210
104.223.79.148
104.227.235.12
104.227.244.140
104.232.71.7
104.232.98.17
104.232.98.18
104.232.98.19
104.232.98.4
104.243.143.78
107.152.213.117
107.172.210.172
107.172.30.141
107.172.57.13
107.172.83.139
107.173.28.8
107.174.20.79
107.174.240.14
107.175.127.234
107.175.172.129
108.170.13.91
108.177.235.110
108.177.235.217
108.177.235.244
111.90.138.218
111.90.146.128
111.90.146.88
111.90.148.22
111.90.151.30
128b37f254e92e2d91f9a7b53cfbeed5428ccd1e
1290181d055156147eeb179457e15001003786bb
144.168.224.235
144.217.41.76
14772f979839e3edab5cae9b7de4ac93d6fef9c8
149.255.35.15
149.255.35.19
149.255.35.25
149.56.200.203
15c96db7785d5e6866e2dc041b6ce98f136c47b6
167.114.56.231
169584fe26f50c8b0f37924da283c94066d9236c
172.241.27.117
172.241.27.207
172.245.86.29
172.81.130.214
172.87.222.3
172.87.222.6
172.93.165.155
172.93.165.19
172.93.165.195
172.93.165.23
172.93.165.49
172.93.178.108
172.93.184.62
172.93.187.203
172.93.188.47
172.93.188.62
172.93.189.176
172.93.189.77
172.93.201.204
172.93.220.108
172.93.220.56
173.209.43.7
173.254.204.68
173.44.48.241
180.235.135.216
185.136.163.171
185.45.193.30
185.62.56.106
185.62.56.107
185.62.56.47
185.62.58.207
1899971acdc871d1161824b69cfb565f0f7e15de
192.111.149.132
192.169.6.12
192.169.6.139
192.210.213.111
192.210.213.178
192.227.248.173
193.29.187.46
193.34.167.10
193.34.167.183
194.15.112.193
198.180.198.6
199.188.103.115
199.188.103.123
19a02f2453b15df76ecd1e798b6530809e9ae158
19b6ad2fdf309c1090c772e8e245a92abd7317e7
19d8925e334d4116f4e93a0f424a1a1907f67f59
19fd3b8a96452ba9a1ca1a41eaa1df4d4c38d4fb
1aab7a644e2de9b545e526eee7accc2d5e12c76b
1d5f886442d231b10fe68894d74bec4bfdcdfe5f
204.12.225.21
209.127.18.108
209.90.234.34
216.189.145.107
216.189.145.108
216.45.54.11
22994c02534f74b442f6ca02c94ae1fe003737ea
22a968beda8a033eb31ae175b7e0a937
23.106.160.40
23.106.223.194
23.108.57.232
23.227.196.116
23.227.196.5
23.227.199.21
23.227.199.53
23.227.199.69
23.227.202.105
23.254.119.12
23.81.246.107
23.81.246.179
23.82.141.172
23.82.141.50
23.94.139.92
23.94.37.55
23.95.67.143
249d865fe438695d5872191e17c4bbd48af1e2a9
24c6b220ea7a2b5de587ed37f0b19186b8b24a33
2b3e68a625a88fffb50bc08083580cf07df1d7b1
2cbbf4952add12302caab5be0840f8471b06f2e6
2dce7f5ae09d1315ae01b4ba9476bb9b1a649b9a
3.239.189.175
304261dcb04ce0fdd936b2da689d7393abf67154
320dd14d32cba4ce25521a83912cbe78f78d5542
37.72.168.228
37.72.175.135
37.72.175.179
37.72.175.196
38fce40e0e6c028ac905a47123fcd5c0f4bbe1a2
399040a20e3891f1332e82e7912087402e005466
3c822a64fdef9fd200dc4ad7446e73d9225b6658
3ce1f8ace1a954a28d9ad7c45624cbab78dd4ce1
3e7fdd91198b48f0eae86f51ab845e7974dd454e
403ad5ef66f3932e548e29e1b6a2cb4f
412903b69697ad696b8789e2a2c2156f349d7a61
45.122.138.130
45.128.156.27
45f2465cc4d8157e41c487dd8e8b0122e132032c
45f62d44f95a2b520b9542209c9394678de084f1
46.21.153.87
46eea848d03a4faed9e07b534edee6117eb7f3c4
471756a047748e931e0c21060014e885763e7643
471e268f24b938c8bdaa6479696066c435b14ceb
486431e2d9024c44fde0cbcbd50e579395945f1e
4d1a23a6d25dbb4d37dcf379103a0922a1059383
4e8c2bbdac96d4df6555df6f219e2a19e4d63046
4fddb38848d0a3043d173653ee5d65a034fa5261
4ffbc2b68bd9eaeb7d3fd5c41a01eb10e3520977
51.38.234.8
519ad7e0cea23556b598fcee6d333d835da001c1
5360a98e4282da4206d35e840df8cf33cd9e965f
54.38.11.132
54.39.204.190
55207654884899dece889e452697492e66a2664f
57bbceafe392c51480ecdc8854d1a177da0798c7
5cd0febfea57a9d4a8462ba3b1c45965529ce8f7
5d0dc50f102bc9ced23e05f53b4b5e83f7dcdb60
5fa1dd26de5449f4160519b690344e5ac150405f
5ff8e100f48ed75cc0a8afe8498007e6894aea6a
60852dcc1bbbd9741544290bc071a3e36298c5bf
61ebfbf45dd7360811b8fd1be367cd714d3bf1b3
63.141.224.90
63.141.234.106
64.188.19.117
64.188.21.141
64.188.26.168
64b628db142ee03dc99f498bc3de017dd1f96ace
64cf462b1ff8cf77143ee0c25ac3049a2c0a986e
66.70.153.86
66209d6585aa2ad80b71a20309b19f5f0f2f102b
6656150ffdca1a739972c3833eb2dbefddb9a917
67.219.150.3
67.43.239.146
67.43.239.181
67.43.239.213
69.12.84.100
69.30.240.60
69.61.74.29
6de65fc57a4428ad7e262e980a7f6cc7
6e55d351c22a077ce3057da3b64b453fae650b1a
6ee218365ec9ff17eb0cdb460e050d8c612244c7
700cd13b53c8bb66fd51eb4c504c8c48807955e4
73e580ef0d8bcc4b9102894d66b902a9a52ed30c
74.121.190.121
74.222.26.164
74e2bc16b2eb69669ef202a3afecd8338e59e5db
76f753e777c8ed6ee3de12fd4a6be829f3ad1bd2
78cb2ff0073f15c6f70f8fb5c2aa6360b9a3e958
796068fe57f59d2d25322cabc1e43329eafa3ae4
7993ab274ba47b8a312859761ca5bc156a985c29
79d255f36da1ef71a3669e4ba6eb3067d4a9edb0
7b66a217fcf61df2fe30a944feca704bdeea0775
7c08dc40e773bc4b8cc9b407777769822c20dfed
7c1ce4cb7776cad28500630d814e08619b665c66
7e413302ef862b5c417b4bf73533b8a55dea19ba
7faf0d0f46ea2698b88daea588775b744fd95cd4
80c0efb9e129f7f9b05a783df6959812
8118c448070336884760c9393e39fd7c937b154a
827b83175168959baa5abbe2ab28e0107309f00b
8309da5cdafbaa578ea7356c429c9d6c974996c6
8384997d8a807c34a15a81c3eeb58560de2816b0
83cfb13531f9a8a81ea96070fde9d8792586b2e2
84.234.96.130
8660990c02e30933a6484e6aab83a4bf4ef02503
8730613623c457bb19f72acc27b06b509658367d
875370a44ec1e53430bf035080b7075f5d0bce54
88093735c7abdbeef298862a0dd33dcca10baa4f
882ce7cd5405cafab60aff1230a103f7d43c9940
88773b940710b631a44435e7dd56d3cc6296c1d5
89.45.4.247
8901a2243f441855864852c9ffc5693ad4973043
8910bdaaa6d3d40e9f60523d3a34f914
8b41da1b919fafcbb6003ff1fdb69dcd6061ff05
8c73fd5aa03b925988227d70c67a64745fa60f3f
8fab75e9930a614b80ae83c99c048b6ed14f886d
8fdf10dd4f32dd546594343f339d37eb41ccc3a0
9083fab3637a60404bc97c04de6bcf6990ea0a25
90a6731fcc1bf18eb47db4a2b8e09a1a4157ea27
91cc94e09af78085095bdf0d6fee78e24976150e
91d4c3ed4336b4898be1825f8769356e1d94042c
91e4a8f0176a0b2bd4fa116d599ae34997592f16
927eea1b33cfe8c00695130698db09f8845bf483
92c50351b2fa5982f2a080aac80624f7f0254836
9443af2bb8c281edc3d4fbe8c3df3ee91820e8ea
95.174.65.244
95038b25dcb22160a39d1c889f3d9cf3e4fbe9e7
96.44.130.126
96.8.118.110
96.9.210.193
994bd84833827c17754a922957c349f3316bb616
99a79ad26ac0c9a96c8ae0153d2e9d0e67c7048d
9b3efb423d54fc96e8b5565262ffc5dbda0e72fe
9df88128e675307d2741adb0a1b128b03beee886
9e984ad780434af458223347620a185c99dc89f6
9f71d3a47cba2dacff5da07e60177d9e0b54439e
a07d545c850c2897537bb4f1afec99840b1bd8b5
a151b18c72f9833e8acae989e287ac787b89926a
a3f893a132566f84d43a65c864d8b753ea973ac8
a4463133c2ec834d92f513c9724afdf15b6003dd
a64b42eefc9b08ac06b5fb40ec4a3a8a76800c3f
a7fcd5d5c2c57fd8a63f202a190aef60abd2ccbf
ac9645de8cfc41c88bf313833f9933480f0cf69f
acc8172dea21a5684f0cdfa48974c70648936402
b138f782e23bc07d239005cd9685441657ae3406
b2ee5568161b0876ab280a267eb51450037b7fd2
b4042f03686336d130527aea3d4e8e66f1c29131
b6aff0910dae32ccd83363f314fc9eddccacdd6d
b869ae4b3f11c9e7dd93a82af99849490d926d91
bb53ba1e90f27896a6e021a7b82551d50994b84f
bbedc28ef631eef2d339f06e13910afe23f60d90
bea49839390e4f1eb3cb38d0fcaf897e
bfde0d8d8c1303b6cc661a6bc269fd222292d170
c001c42aba2d922ca044d43a0b081e0ab72a2a52
c1b5e79e754de08d680beeb5cacee9603c62b677
c39fa61ef4210f6726fb2b8f775baa3efe655c67
c5818365ccd628750e692f599b6d9adb99a3c389
c67dca446f3dd6fb43367cda562b5d1e1e632125
c7137530011eb2d0fcaba4f14ba695e4b9c65f25
c768b27d57e658efd6e7ccef988e57334289acf1
c9ed6bcd81b64a9c92574e94686c76b3cbf2ec64
cad779915537cfed7c37abf5b143be793c9db6f2
cae2fe70b7f98e4b3039298426d7d7528a7ecc8e
caec7c0a802e4de75a671327a9a68a2a7e55936d
cc2f66f648430deb60a11a1c74c45a6ee8349907
cef99063e85af8b065de0ffa9d26cb03
d16a7642d2519fcd1030b9b3a4403b178e7487f7
d18ff190c769cf2bcf32a5b0237af02fdc2d646d
d44c7ed99abd47db577fbfd10d8018b6301f22a2
dbe39ba1d753f1a0a027db968533b864c98c9cd9
e02961445c52cb9a2aa0a09e9a452bc10c79d4ae
e12c332b4f0e11b0de8e80e993d5e02b9c2bfc84
e46da2ddb96d4d712f0837595b114ea315d49ac4
e602553c2ac94f007afce32aef47e5b3fcc94177
e9321bdc979ae55a60e677c9ea8e0e17f0e722de
e9f88241ead0a454c5405de92071f5b4cb3e36e9
eb64df15cb2ca5e6fca6f3e809920a21a3115be0
eb847b373aa9284a2207800bf3b0c7a4a4ed999c
eca6dbf704151283a21aaaa1f6fa9e4990012e13
ed96ea65fc7d34ed0a782788382e167bc7123d14
f05437d510287448325bac98a1378de1
f18d9d4670b051c264518346cbb48d2a3c90e54d
f2070d2c6aedc6ac0b5ae8e1a151d2a69b5823ac
f60cb35c79241267f1eac4bbc20a22cc92e0cecb
f651db5f19216d2a036f7c400b386f0bfa36c24c
f84213fd940f019505e58a79218b9a17543fa3e4
f9acf669ccf7a443d1df57e441fdcb50df624c13
fb2f3ffd2ac88dd62876159d155ba717c139cf11
fd4904bfd24de6da6be7c04c1f5dd7f7e96a43c8
fde0767ca94148a1beaf3e3184b919631f38b5c9
fe6615d6e40d45524ff32534c45c32890931945d
febb999755a880203e8452fd5ba57d9ae68f6604