Vyveva constitutes yet another addition to Lazarus’s extensive malware arsenal. The loader serves to decrypt the backdoor using a simple XOR decryption algorithm. The backdoor features capabilities for file exfiltration, timestomping, gathering information about the victim computer and its drives, and other common backdoor functionality such as running arbitrary code specified by the malware’s operators. So far, we have been able to find its installer, loader and main payload – a backdoor with a TorSocket DLL.