Lizar

Malware updated 4 months ago (2024-05-04T20:52:06.058Z)

Download STIX

Preview STIX

Lizar, also known as Tirion or Diceloader, is a malicious software developed by the threat group ITG14. It's designed to exploit and damage computers or devices, infiltrating systems through suspicious downloads, emails, or websites. Once installed, it can steal personal information, disrupt operations, or hold data hostage for ransom. Lizar uses a CRC algorithm to create its hash, and has a variety of plugins, such as Jumper32/Jumper64.dll which can load payloads using different methods. Additionally, it contains functionality like ListProcesses32/ListProcesses64.dll plugin, which enumerates running processes and sends a list of process names and IDs back to the Command and Control (C2) server. The Domino Backdoor malware shares significant code overlap with Lizar, incorporating elements that appear in some of Lizar's plugins. This includes the ability to gather system information and send it to the C2, similar to Lizar’s Info32/Info64.dll plugin. The bot ID format used by Domino Backdoor is also similar to that generated by Lizar, which uses a checksum of system information combined with the process ID. However, unlike Lizar, Domino employs a custom algorithm that XORs multiple values together to create its hash. In May 2023, the notorious hacker group FIN7, also known as Sangria Tempest, reportedly used the Lizar backdoor to distribute Clop ransomware on victims' machines. These attacks also utilized custom PowerShell scripts to retrieve stored credentials from backup servers, gather system information, and establish a foothold in compromised hosts by executing Diceloader every time the device boots up. The script was used to reflectively load additional payloads into the system, specifically an embedded Lizar dynamic-link library (DLL).

Description last updated: 2024-05-04T19:37:16.091Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Diceloader	5	Diceloader is a type of malware, short for malicious software, that is designed to infiltrate and damage computer systems. It can infect systems through various means such as suspicious downloads, emails, or websites, often without the user's knowledge. Once inside a system, it can steal personal in
Tirion	4	Tirion, also known as Lizar or DiceLoader, is a type of malware developed by the threat group ITG14, also known as FIN7. First reported in March 2020, Tirion has been observed in numerous ITG14 campaigns up until the end of 2022. This malicious software can infiltrate systems through suspicious down
Domino Backdoor	2	The Domino Backdoor is a type of malware that has been linked to multiple threat groups, highlighting the complexity of tracking these actors and their operations. This malicious software, designed to exploit and damage computers or devices, can steal personal information, disrupt operations, or hol

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Backdoor

Malware

Loader

Payload

exploitation

Bot

Exploit

Cobalt Strike

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

ID	Type	Votes	Profile Description
Domino	Unspecified	3	The Domino malware, a harmful program designed to exploit and damage computer systems, has been identified as the culprit behind a series of high-profile cyber attacks. The first notable incident occurred when a hacker claimed to have accessed Domino's India's massive 13 TB database on the Dark Web,
Carbanak	Unspecified	3	Carbanak is a sophisticated malware known for its involvement in various cyberattacks since it was first identified. This malicious software, created by the Russian criminal group FIN7 (also known as Carbanak, Carbon Spider, Cobalt Group, Navigator Group), has been active since mid-2015. The group p

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

ID	Type	Votes	Profile Description
FIN7	Unspecified	6	FIN7, a prominent threat actor in the cybercrime landscape, has been noted for its malicious activities and innovative tactics. Known for their relentless attacks on large corporations, FIN7 recently targeted a significant U.S. carmaker with phishing attacks, demonstrating their continued evolution
Sangria Tempest	Unspecified	2	Sangria Tempest, also known as FIN7, Carbon Spider, and ELBRUS, is a threat actor that has been active since 2014. This Russian advanced persistent threat (APT) group is known for its malicious activities, including spear-phishing campaigns, malware distribution, and theft of payment card data. In m
ITG14	Unspecified	2	ITG14, a threat actor identified in the cybersecurity industry, has recently been linked to malicious activities involving the Domino Backdoor. X-Force researchers have found substantial evidence connecting the Domino Backdoor to ITG14’s Carbanak Backdoor. The Domino Backdoor not only shares signifi

Source Document References

Information about the Lizar Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	a year ago	LockBit, BlackCat, and Clop Prevail as Top RAAS Groups: Ransomware in 1H 2023
CERT-EU	a year ago	Microsoft Confirms PaperCut Servers Used to Deliver LockBit and Cl0p Ransomware
CERT-EU	a year ago	FIN7 cybergang tied to April PaperCut attacks \| #ransomware \| #cybercrime – National Cyber Security Consulting
MITRE	2 years ago	FIN7 Backdoor Masquerades as Ethical Hacking Tool
SecurityIntelligence.com	a year ago	Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor
DARKReading	a year ago	FIN7, Former Conti Gang Members Collaborate on 'Domino' Malware
Securityaffairs	a year ago	The intricate relationships between the FIN7 group and members of the Conti gang
CERT-EU	a year ago	Плодотворное сотрудничество бывших хакеров Conti с группировкой FIN7 привело к распространению вредоносов Domino и Nemesis
SecurityIntelligence.com	a year ago	Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor
CERT-EU	a year ago	Ransomware gang exploiting unpatched Veeam backup products \| #ransomware \| #cybercrime – National Cyber Security Consulting
CERT-EU	a year ago	FIN7 Hackers Caught Exploiting Recent Veeam Vulnerability
CERT-EU	a year ago	Недавно обнаруженная уязвимость Veeam уже используется хакерами FIN7 для кражи конфиденциальных данных
CSO Online	a year ago	Cybercrime group FIN7 targets Veeam backup servers
CERT-EU	a year ago	Le groupe d'attaquants FIN7 cible les serveurs de sauvegarde Veeam - Le Monde Informatique
CERT-EU	a year ago	FIN7 не сдается: хакеры вернулись с новым рансомваром Clop
Securityaffairs	a year ago	FIN7 gang returned and was spotted delivering Clop ransomware
CERT-EU	a year ago	FIN7 cybercrime syndicate uses Clop ransomware in new wave of attacks