Lizar

Malware & Tools · Lizar

· MalwareS0681 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Lizar is a modular remote access tool written using the .NET Framework that shares structural similarities to Carbanak. It has likely been used by FIN7 since at least February 2021.(Citation: BiZone Lizar May 2021)(Citation: Threatpost Lizar May 2021)(Citation: Gemini FIN7 Oct 2021)

Tactic Coverage

discovery (8)stealth (6)execution (4)command and control (4)credential access (3)privilege escalation (3)collection (2)resource development (1)

Used By (1 groups)

G0046FIN7GOLD NIAGARA, ITG14

Techniques (28)

T1003.001LSASS Memory

credential access

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1033System Owner/User Discovery

discovery

T1049System Network Connections Discovery

discovery

T1055Process Injection

stealthprivilege escalation

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1055.002Portable Executable Injection

stealthprivilege escalation

T1057Process Discovery

discovery

T1059.001PowerShell

execution

T1059.003Windows Command Shell

execution

T1059.006Python

execution

T1082System Information Discovery

discovery

T1087.003Email Account

discovery

T1095Non-Application Layer Protocol

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1113Screen Capture

collection

T1132.002Non-Standard Encoding

command and control

T1140Deobfuscate/Decode Files or Information

stealth

T1217Browser Information Discovery

discovery

T1518.001Security Software Discovery

discovery

T1555.003Credentials from Web Browsers

credential access

T1555.004Windows Credential Manager

credential access

T1560Archive Collected Data

collection

T1573Encrypted Channel

command and control

T1588.002Tool

resource development

T1620Reflective Code Loading

stealth

References

https://attack.mitre.org/software/S0681 https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/https://geminiadvisory.io/fin7-ransomware-bastion-secure/https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/