216.73.217.22

APT-C-26 (Lazarus)

· Published 21/12/2025 00:49 · Modified 21/12/2025 00:49 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 00:49
Modified
21/12/2025 00:49
Updated at
21/12/2025 00:49
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
4 reports, 43 attack patterns (mitre), 4 malware, 5 sectors, 38 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (4)

Attack patterns (MITRE) (43)

  • T1102.002 uses
    Bidirectional Communication
  • T1132.001 uses
    Standard Encoding
  • T1562 uses
    Impair Defenses
  • Inter-Process Communication uses
    T1559
  • T1566 uses
    Phishing
  • T1571 uses
    Non-Standard Port
  • T1105 uses
    Ingress Tool Transfer
  • T1036 uses
    Masquerading
  • T1070 uses
    Indicator Removal
  • BITS Jobs uses
    T1197
  • T1134 uses
    Access Token Manipulation
  • T1064 uses
    Scripting
  • T1573 uses
    Encrypted Channel
  • T1082 uses
    System Information Discovery
  • T1547 uses
    Boot or Logon Autostart Execution
  • T1057 uses
    Process Discovery
  • T1093 uses
  • T1112 uses
    Modify Registry
  • T1021 uses
    Remote Services
  • T1113 uses
    Screen Capture
  • T1041 uses
    Exfiltration Over C2 Channel
  • T1132 uses
    Data Encoding
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1078 uses
    Valid Accounts
  • T1027 uses
    Obfuscated Files or Information
  • T1553 uses
    Subvert Trust Controls
  • T1497 uses
    Virtualization/Sandbox Evasion
  • T1115 uses
    Clipboard Data
  • T1204.002 uses
    Malicious File
  • T1055 uses
    Process Injection
  • T1095 uses
    Non-Application Layer Protocol
  • T1056 uses
    Input Capture
  • T1099 uses
  • T1090 uses
    Proxy
  • T1204 uses
    User Execution
  • T1005 uses
    Data from Local System
  • T1568 uses
    Dynamic Resolution
  • T1059 uses
    Command and Scripting Interpreter
  • T1001 uses
    Data Obfuscation
  • T1195 uses
    Supply Chain Compromise
  • T1071 uses
    Application Layer Protocol
  • TA0011 uses
  • T1573.001 uses
    Symmetric Cryptography

Malware (4)

  • Loader1.dll uses
    Family
    Published 02/01/2025 15:25 · Modified 02/01/2025 15:25
  • Dll64.dll uses
    Family
    Published 02/01/2025 15:25 · Modified 02/01/2025 15:25
  • ATT_Loader_DLL.dll uses
    Family
    Published 02/01/2025 15:25 · Modified 02/01/2025 15:25
  • Comebacker uses
    Family
    Published 10/11/2025 11:12 · Modified 10/11/2025 11:12

Sectors (5)

  • Defense targets
  • Government targets
  • Finance targets
  • Technology targets
  • Aerospace targets

Indicators (38)

  • 24b89c77eaeebd4b02c8e8ab6ad3bd7abaa18893ecd469a6a04eda5e374dd305 indicates
  • http://91.206.178.125:80 indicates
  • 1a9cea5e43cfe6377b20f09becf8547deba702718d1ee220ef677f53f30e820d indicates
  • 01c5836655c6a4212676c78ec96c0ac6b778a411e61a2da1f545eba8f784e980 indicates
  • 973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c indicates
  • jdkgradle.com indicates
  • www.rowdensurname.org indicates
  • c56c94e21913b2df4be293001da84c3bb20badf823ccf5b6a396f5f49df5efff indicates
  • 173e6bc33efc7a03da06bf5f8686a89bbed54b6fc8a4263035b7950ed3886179 indicates
  • cryptocedia.com indicates
  • 69074ed2c9c0e89d30217ef872e0ee96c34e7bbbd5aaf3380d9ce5acb45c1041 indicates
  • 378e21bdaf18fe92b3f8ad9bef04dadd57a4271a4a5d4e00c9d73174695a07a2 indicates
  • http://91.206.178.125/upload/upload.asp indicates
  • https://cryptocedia.com/upgrade/latest.asp indicates
  • 3ab6e6fc888e4df602eff1c5bc24f3e976215d1e4a58f963834e5b225a3821f5 indicates
  • 33be1a646e5ed46aa707455637e2116715592d1ef63feafb0fd2f66c872a634d indicates
  • pypi.online indicates
  • 70c5b64589277ace59db86d19d846a9236214b48aacabbaf880f2b6355ab5260 indicates
  • 17d3593519f6a016879093bfb7cc63070646951191e28c1dfad52942099f59cc indicates
  • angeldonationblog.com indicates
  • 31cc9820037fe45e0f27ea594b9f4c85ce4eaa9b95ae2a802cf7753e142afe85 indicates
  • a5caf7e9afc5c034c72f50c831822ee54a307a04fef2d75a21094ef28ff1b306 indicates
  • 2c8f00824ca2b4ddb4e2e910ee042ba46a570984d1bc094f0014655d883b8519 indicates
  • b4c8c149005a43ae043038d4d62631dc1a0f57514c7cbf4f7726add7ec67981a indicates
  • 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670 indicates
  • e9d478dca6ce1b642abfdb94af21f0d567594479a14d3780e148400649591fcf indicates
  • 6bba8f488c23a0e0f753ac21cd83ddeac5c4d14b70d4426d7cdeebdf813a1094 indicates
  • chaingrown.com indicates
  • b8e69d6a766b9088d650e850a638d7ab7c9f59f4e24e2bc8eac41c380876b0d8 indicates
  • fasttet.com indicates
  • 8fb6d8a5013bd3a36c605031e86fd1f6bb7c3fdba722e58ee2f4769a820b86b0 indicates
  • 60c080a29f58cf861f5e7c7fc5e5bddc7e63dd1db0badc06729d91f65957e9ce indicates
  • arcashop.org indicates
  • 26437bc68133c2ca09bb56bc011dd1b713f8ee40a2acc2488b102dd037641c6e indicates
  • 956d2ed558e3c6e447e3d4424d6b14e81f74b63762238e84069f9a7610aa2531 indicates
  • 000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923 indicates
  • blockchain-newtech.com indicates
  • b4a04b450bb7cae5ea578e79ae9d0f203711c18c3f3a6de9900d2bdfaa4e7f67 indicates