Lazarus_Group__2016__Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf

This Novetta Operation Blockbuster reverse‑engineering report analyzes Lazarus Group tooling (installers, loaders, uninstallers) used to deliver and persist multiple malware families (Romeo*, Delta*, Whiskey*, PapaAlfa, etc.). It catalogs technical behaviors (resource‑embedded payloads, dynamic API loading, manual DLL mapping, service installation, suicide scripts, C2 protocols, payload storage formats), variant differences, and observed campaign artifacts and IOCs, providing actionable TTPs for detection and response.