Lizar

Lizar, also known as Tirion or Diceloader, is a malicious software developed by the threat group ITG14. It's designed to exploit and damage computers or devices, infiltrating systems through suspicious downloads, emails, or websites. Once installed, it can steal personal information, disrupt operations, or hold data hostage for ransom. Lizar uses a CRC algorithm to create its hash, and has a variety of plugins, such as Jumper32/Jumper64.dll which can load payloads using different methods. Additionally, it contains functionality like ListProcesses32/ListProcesses64.dll plugin, which enumerates running processes and sends a list of process names and IDs back to the Command and Control (C2) server. The Domino Backdoor malware shares significant code overlap with Lizar, incorporating elements that appear in some of Lizar's plugins. This includes the ability to gather system information and send it to the C2, similar to Lizar’s Info32/Info64.dll plugin. The bot ID format used by Domino Backdoor is also similar to that generated by Lizar, which uses a checksum of system information combined with the process ID. However, unlike Lizar, Domino employs a custom algorithm that XORs multiple values together to create its hash. In May 2023, the notorious hacker group FIN7, also known as Sangria Tempest, reportedly used the Lizar backdoor to distribute Clop ransomware on victims' machines. These attacks also utilized custom PowerShell scripts to retrieve stored credentials from backup servers, gather system information, and establish a foothold in compromised hosts by executing Diceloader every time the device boots up. The script was used to reflectively load additional payloads into the system, specifically an embedded Lizar dynamic-link library (DLL).