Lazarus Campaign Targeting Cryptocurrencies Reveals Remote C

Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More

Indicators of Compromise (IoCs):

Hashes detected as BKDR_RATANKBA.ZAEL.A

1768f2e9cea5f8c97007c6f822531c1c9043c151187c54ebfb289980ff63d666
6cac0be2120be7b3592fe4e1f7c86f4abc7b168d058e07dc8975bf1eafd7cb25
d844777dcafcde8622b9472b6cd442c50c3747579868a53a505ef2f5a4f0e26a
db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471
f7f2dd674532056c0d67ef1fb7c8ae8dd0484768604b551ee9b6c4405008fe6b
Hashes detected as CHM_DLOADER.ZCEL.A

01b047e0f3b49f8ab6ebf6795bc72ba7f63d7acbc68f65f1f8f66e34de827e49
030b4525558f2c411f972d91b144870b388380b59372e1798926cc2958242863
10cbb5d0974af08b5d4aa9c753e274a81348da9f8bfcaa5193fad08b79650cda
650d7b814922b58b6580041cb0aa9d27dae7e94e6d899bbb3b4aa5f1047fca0f
6cb1e9850dd853880bbaf68ea23243bac9c430df576fa1e679d7f26d56785984
6d4415a2cbedc960c7c7055626c61842b3a3ca4718e2ac0e3d2ac0c7ef41b84d
772b9b873100375c9696d87724f8efa2c8c1484853d40b52c6dc6f7759f5db01
9d10911a7bbf26f58b5e39342540761885422b878617f864bfdb16195b7cd0f5
d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48
Hashes detected as JS_DLOADER.ZBEL.A

8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3
Hashes detected as X97M_DLOADR.ZBEL.A

972b598d709b66b35900dc21c5225e5f0d474f241fefa890b381089afd7d44ee
Hashes detected as VBS_DLOADR.ZAEL.A

4722138dda262a2dca5cbf9acd40f150759c006f56b7637769282dba54de0cab

https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/