Shares tag: YARA • Published within a month
Detects a malicious DLL used by a North Korean Threat actor Lazarus
2024-03-14 • Rusty Noob619 •
https://github.com/RustyNoob-619/100-Days-of-YARA-2024/blob/main/Day74.yar
A YARA rule identifies a Lazarus-linked malicious DLL sample shared in March 2024, keyed to SHA-256 5289529957d52c9d5fc2e47aa9924fd1de21b902509dee0241d5d6b056733a94. The rule looks for Windows internet settings strings, SeDebugPrivilege, AutoConfigURL, HTTP form content headers, zlib-style diagnostic strings, and a PE import profile spanning KERNEL32, ole32, SHELL32, and ADVAPI32 APIs. It also requires exported functions such as InitProcessPriv, InitThread, ShutdownLockAppHostServer, StartLockAppHostServer, UnInitProcessPriv, and UnInitThread. The source is a detection artifact rather than a full intrusion report, so it supports hunting for the referenced Lazarus DLL but provides little victim or campaign context.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| YARA | DLL_North_Korean_Lazarus_March2… | 2024-03-14 | 2024-03-14 |
| HASH | 5289529957d52c9d5fc2e47aa9924fd… | 2024-03-14 | 2024-03-14 |
Related Reports
Shares tag: YARA • Published within a week
Shares tag: YARA • Published within a week
Shares tag: YARA • Published within a week
2024-02-19 •
60% Match
#News
#YARA
#T1140
#T1041
#T1046
#T1071
#T1059
#T1001
#T1078
#T1133
#T1021
#T1040
#T1572
#T1213
Shares tag: YARA • Published within a month
Shares tag: YARA