Lazarus_Group__2020__CN_Dacls_the_Dual_platform_RAT.pdf
ID: 81af6f2c-eb60-4365-9ae6-319bd00618b0
STIX ID: report--81af6f2c-eb60-4365-9ae6-319bd00618b0
Threat Score
90/100
Uploaded: 2026-08-15
Published Date: 2020-01-09
Last Modified Date: 2020-01-09
Created by: dogesec
TLP:CLEAR
ADMIRALTY:B2
PAP:CLEAR
...
...
**Executive Summary:** 360Netlab presents a detailed analysis of Dacls, a modular, cross-platform RAT (Windows/Linux) attributed to the Lazarus Group; it documents initialization, AES/TLS+RC4 C2 communications, plugin capabilities (command execution, file/process management, reverse-proxy, port scanning), evidence of delivery via Confluence CVE-2019-3396, and includes sample MD5s, hardcoded C2 IPs and URLs plus mitigation advice.