Lizar

Malware updated 5 months ago (2024-05-04T20:52:06.058Z)
Download STIX
Preview STIX
Lizar, also known as Tirion or Diceloader, is a malicious software developed by the threat group ITG14. It's designed to exploit and damage computers or devices, infiltrating systems through suspicious downloads, emails, or websites. Once installed, it can steal personal information, disrupt operations, or hold data hostage for ransom. Lizar uses a CRC algorithm to create its hash, and has a variety of plugins, such as Jumper32/Jumper64.dll which can load payloads using different methods. Additionally, it contains functionality like ListProcesses32/ListProcesses64.dll plugin, which enumerates running processes and sends a list of process names and IDs back to the Command and Control (C2) server. The Domino Backdoor malware shares significant code overlap with Lizar, incorporating elements that appear in some of Lizar's plugins. This includes the ability to gather system information and send it to the C2, similar to Lizar’s Info32/Info64.dll plugin. The bot ID format used by Domino Backdoor is also similar to that generated by Lizar, which uses a checksum of system information combined with the process ID. However, unlike Lizar, Domino employs a custom algorithm that XORs multiple values together to create its hash. In May 2023, the notorious hacker group FIN7, also known as Sangria Tempest, reportedly used the Lizar backdoor to distribute Clop ransomware on victims' machines. These attacks also utilized custom PowerShell scripts to retrieve stored credentials from backup servers, gather system information, and establish a foothold in compromised hosts by executing Diceloader every time the device boots up. The script was used to reflectively load additional payloads into the system, specifically an embedded Lizar dynamic-link library (DLL).
Description last updated: 2024-05-04T19:37:16.091Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Diceloader is a possible alias for Lizar. Diceloader is a type of malware, short for malicious software, that is designed to infiltrate and damage computer systems. It can infect systems through various means such as suspicious downloads, emails, or websites, often without the user's knowledge. Once inside a system, it can steal personal in
5
Tirion is a possible alias for Lizar. Tirion, also known as Lizar or DiceLoader, is a type of malware developed by the threat group ITG14, also known as FIN7. First reported in March 2020, Tirion has been observed in numerous ITG14 campaigns up until the end of 2022. This malicious software can infiltrate systems through suspicious down
4
Domino Backdoor is a possible alias for Lizar. The Domino Backdoor is a type of malware that has been linked to multiple threat groups, highlighting the complexity of tracking these actors and their operations. This malicious software, designed to exploit and damage computers or devices, can steal personal information, disrupt operations, or hol
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Backdoor
Malware
Loader
Payload
exploitation
Bot
Exploit
Cobalt Strike
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The Domino Malware is associated with Lizar. Domino is a malicious software (malware) that has been causing significant disruption and harm in recent times. The malware was first identified when it infiltrated the IBM Domino Server, a platform used widely for hosting critical applications and services. Despite security measures such as ESET MaUnspecified
3
The Carbanak Malware is associated with Lizar. Carbanak is a notorious malware developed by the cybercrime collective known as FIN7, also referred to as Carbon Spider, Cobalt Group, and Navigator Group. The group, which has been active since 2012, is of Russian origin and has been particularly focused on exploiting the restaurant, gambling, and Unspecified
3
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The FIN7 Threat Actor is associated with Lizar. FIN7, also known as Carbanak, is a Russian cybercrime group that has been active since mid-2015. They are known for their malicious activities primarily targeting the restaurant, gambling, and hospitality industries in the United States to harvest financial information which is then used in attacks Unspecified
6
The Sangria Tempest Threat Actor is associated with Lizar. Sangria Tempest, also known as Carbon Spider, Elbrus, and FIN7, is a threat actor that has been active since 2013. In mid-November 2023, Microsoft observed Sangria Tempest using Storm-1113's EugenLoader delivered through malicious MSIX package installations. The group frequently targets the restauraUnspecified
2
The ITG14 Threat Actor is associated with Lizar. ITG14, a threat actor identified in the cybersecurity industry, has recently been linked to malicious activities involving the Domino Backdoor. X-Force researchers have found substantial evidence connecting the Domino Backdoor to ITG14’s Carbanak Backdoor. The Domino Backdoor not only shares signifiUnspecified
2
Source Document References
Information about the Lizar Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
MITRE
2 years ago
SecurityIntelligence.com
a year ago
DARKReading
a year ago
Securityaffairs
a year ago
CERT-EU
a year ago
SecurityIntelligence.com
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CSO Online
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
Securityaffairs
a year ago
CERT-EU
a year ago