EC9B94EAB084-Security-Report-2018EB8584-11EC9B94.pdf (576 KB)

SomanSA analyzed an October 2018 Lazarus APT operation against specific South Korean targets that used emails impersonating a lawyer and attached a malicious HWP document disguised as a normal file. The HWP contained a malicious PostScript component with shellcode that contacted a distribution server, selected a payload based on the victim OS version, and downloaded XOR-encoded DLL malware. After decryption and execution, the DLL connected to C2 servers including theinspectionconsultant[.]com, danagloverinteriors[.]com, and as-brant[.]ru to await attacker commands. The report links the activity to Lazarus through reused internal names battle32.dll and battle64.dll, metadata and functions associated with the Sony Pictures attack, and a code string previously seen in Lazarus activity earlier that year.