Microsoft Word - Lazarus Report.docx

This report analyzes a spyware implant linked to APT37 used in a 1 January 2019 campaign against the South Korean Unification Ministry, documenting anti-analysis protections (VMProtect, VM and debugger detection), persistence via a dropped HncChecker.dll installed as a service, second-stage DLLs for different architectures, keystroke logging to C:\ProgramData\Hnc\userdata.cab, and strings indicating command-and-control, file transfer and remote-command capabilities; the report includes file metadata and MD5 hashes as IOCs.