Lazarus Group is back with RemotePE malware.

Lazarus Group returns with RemotePE malware aimed at global financial firms

According to a report by the website SCWorld, the return of hackers from North Korea, the Lazarus Group, along with a new malware, RemotePE, a remote access trojan type of malware, was detected by the Fox-IT research team, part of the leading cybersecurity firm NCC Group. The research team noted that the Lazarus Group's campaign was particularly focused on the financial company and the Kryptokerrenzi group.

For the process of spreading malware into the system, a multi-layer embedded method (Multi-Stages Infection) is used to implement two different malware loaders, DPAPILoader and RemotePELoader. DPAPILoader is used to decryption and reload the RemotePELoader malware with the Windows Data Protection API. After the RemoteLoPEader malware has been loaded, the malware will contact the C2 or Command and and Control server to download the real malware RemotePE directly into the memory (In-Memory Execution). )

The capabilities of this malware can be called very versatile because it can receive a variety of commands from the C2 server, covering file management on the victim's machine (File Operations), Process Manipulation, and Self-Management. Not only does the malware have features to use a variety of file deletion methods, such as overwriting the original file several times before deleting it. In addition, the malware uses a variety of techniques to evade detection, such as patching the Windows event tracking feature or Event Tracing for Windows (ETW). It is not possible to track malware movements on the system and use Hell's Gate techniques to evade EDR or Endpoint Detection and Response.

# Trending # Lemon 8 Howtoo # lemon 8 diary # lazarusgroup # freedomhack