1. Home
  2. Software
  3. DRATzarus

DRATzarus

DRATzarus is a remote access tool (RAT) that has been used by Lazarus Group to target the defense and aerospace organizations globally since at least summer 2020. DRATzarus shares similarities with Bankshot, which was used by Lazarus Group in 2017 to target the Turkish financial sector.[1]

ID: S0694
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 24 March 2022
Last Modified: 17 March 2023
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

DRATzarus can collect information from a compromised host.[1]
Enterprise T1036 .005 伪装: Match Legitimate Name or Location

DRATzarus has been named Flash.exe, and its dropper has been named IExplorer.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

DRATzarus can use HTTP or HTTPS for C2 communications.[1]
Enterprise T1106 本机API

DRATzarus can use various API calls to see if it is running in a sandbox.[1]
Enterprise T1027 混淆文件或信息

DRATzarus can be partly encrypted with XOR.[1]
.002 Software Packing

DRATzarus's dropper can be packed with UPX.[1]
Enterprise T1033 系统所有者/用户发现

DRATzarus can obtain a list of users from an infected machine.[1]
Enterprise T1124 系统时间发现

DRATzarus can use the GetTickCount and GetSystemTimeAsFileTime API calls to inspect system time.[1]
Enterprise T1497 .003 虚拟化/沙盒规避: Time Based Evasion

DRATzarus can use the GetTickCount and GetSystemTimeAsFileTime API calls to measure function timing.[1] DRATzarus can also remotely shut down into sleep mode under specific conditions to evade detection.[1]
Enterprise T1622 调试器规避

DRATzarus can use IsDebuggerPresent to detect whether a debugger is present on a victim.[1]
Enterprise T1105 输入工具传输

DRATzarus can deploy additional tools onto an infected machine.[1]
Enterprise T1057 进程发现

DRATzarus can enumerate and examine running processes to determine if a debugger is present.[1]
Enterprise T1018 远程系统发现

DRATzarus can search for other machines connected to compromised host and attempt to map the network.[1]

Groups That Use This Software

ID Name References
G0032 Lazarus Group

[1][2][3][4]

Campaigns

ID Name Description
C0022 Operation Dream Job

During Operation Dream Job, Lazarus Group used DRATzarus to deploy open source software and partly commodity software such as Responder, Wake-On-Lan, and ChromePass to target infected hosts.[1]

References

  1. ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
  2. Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021.
  1. Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.
  2. Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021.