Lazarus APT Uses Modular Backdoor to Target Financial Institutions

guest · Nov 21, 2018

Lazarus APT Uses Modular Backdoor to Target Financial Institutions
November 23, 2018
https://news.softpedia.com/news/laz...to-target-financial-institutions-523908.shtml

As unearthed by the Trend Micro research team, the APT38 threat group successfully compromised a number of computing systems owned by multiple financial institutions from Latin America.

Lazarus' backdoor used three different components to completely own its targets, with the AuditCred.dll/ROptimizer.dll being the loader launched as a service, Msadoz.dll being the actual encrypted backdoor malware, and Auditcred.dll.mui/rOptimizer.dll.mui the malware's encrypted configuration file.

"The loader DLL is installed as a service and uses different names (AuditCred and ROptimizer) on different machines," said Trend Micro in their analysis.
[...] the APT38 backdoor also used a convoluted storage setup designed to obfuscate its presence and make removal as hard as possible, with the loader being stored in one location and the encrypted backdoor being holed up somewhere else on the drive.
Click to expand...

Log in or Sign up

Lazarus APT Uses Modular Backdoor to Target Financial Institutions

guest Guest

Log in or Sign up

Lazarus APT Uses Modular Backdoor to Target Financial Institutions

guest Guest

Useful Searches