Lazarus_Group__2022__Kaspersky_Lazarus-Trojanized-DeFi-delivering-malware_03-31-2022.pdf

This report describes a Lazarus APT campaign in which attackers distributed a Trojanized DeFi Wallet installer (DeFi-App.exe) that drops and launches a disguised backdoor (GoogleChrome.exe). The analysis covers the multi-stage infection flow, payload structure and behavior (RC4+Base64 C2, extensive backdoor commands including discovery, file operations, remote execution, and timestomping), compromised South Korean web servers used as staged C2s, code and script overlaps linking the activity to the Lazarus/CookieTime/ThreatNeedle clusters, MITRE ATT&CK mapping, and a list of IoCs for detection and takedown.