The Lazarus downloader analysis builds on previously identified January 2019 samples and derives a YARA detection for a related payload. Sandbox behavior showed the malware beaconing to a control server with an HTTP request for an info.asp path, providing network evidence for detection. The source is primarily a technical malware note, with useful C2 and rule-development details rather than broad campaign context.