Actor(s): Lazarus Group
LPEClient is an HTTP(S) downloader that expects two command line parameters: an encrypted string containing two URLs (a primary and a secondary C&C server), and the path on the victim's file system to store the downloaded payload.
It sends detailed information about the victim's environment, like computer name, type and number of processors, computer manufacturer, product name, major and minor Windows versions, architecture, memory information, installed security software and the version of the ntoskrnl.exe from its version-information resource.
LPEClient uses specific 32-bit values to represent its execution state (0x59863F09 when connecting via the WinHTTP interface, 0xA9348B57 via WinINet), or the nature of HTTP requests to the C&C servers (0xF07D6B34 when sending system information, 0xEF8C0D51 when requesting a DLL payload, 0xCB790A25 when reporting the successful loading of the DLL, 0xD7B20A96 when reporting the state of the the DLL execution). As the final step, malware looks for the export CloseEnv and executes it.
|2023-10-27 ⋅ Kaspersky ⋅ |
A cascade of compromise: unveiling Lazarus’ new campaign
|2023-04-12 ⋅ Kaspersky Labs ⋅ |
Following the Lazarus group by tracking DeathNote campaign
Bankshot BLINDINGCAN ForestTiger LambLoad LPEClient MimiKatz NedDnLoader Racket Downloader Volgmer
|2021-10-08 ⋅ Virus Bulletin ⋅ |
Multi-universe of adversary: multiple campaigns of the Lazarus group and their connections
Dacls AppleJeus AppleJeus Bankshot BookCodes RAT Dacls DRATzarus LCPDot LPEClient
|2021-10-07 ⋅ Virus Bulletin ⋅ |
Operation Bookcodes – targeting South Korea
BookCodes RAT LPEClient
|2021-02-25 ⋅ Kaspersky Labs ⋅ |
Lazarus targets defense industry with ThreatNeedle
HTTP(S) uploader LPEClient Volgmer
|2020-08-13 ⋅ ClearSky ⋅ |
Operation ‘Dream Job’ Widespread North Korean Espionage Campaign
DRATzarus LPEClient NedDnLoader
There is no Yara-Signature yet.