Lazarus_Group__2023__ESET_WinorDLL64-Lazarus-arsenal_02-23-2023.pdf

ESET researchers analyzed WinorDLL64, a DLL backdoor delivered by the Wslink loader that provides extensive system reconnaissance, file exfiltration/manipulation, process control, and remote command execution over an existing encrypted channel; the analysis includes code/behavior overlaps with known Lazarus samples (low-confidence attribution), technical details of commands and communication, IoCs (SHA-1), and MITRE ATT&CK technique mappings.