IPMsg is the legitimate IP Messenger application impersonated by a Lazarus malware package. The weaponized installer used the genuine filename, decrypted several DLL stages into memory, and launched a real IPMsg installer to conceal execution. Parameter checks hindered isolated sandbox analysis. The final DLL generated a victim identifier, repeatedly contacted command-and-control infrastructure, decoded task metadata, downloaded HC-256-encrypted ZIP archives containing DLL payloads, verified their hashes and names, executed selected exports, and returned results to the operators in chunks.