MITRE ATT&CKsoftware (malware)

S0681 Lizar

Published 2022-02-02 Modified 2025-10-03 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Tirion, Icebot, DiceLoader
Version
2.0
Created
2022-02-02

Description

Lizar is a modular remote access tool written using the .NET Framework that shares structural similarities to Carbanak. It has likely been used by FIN7 since at least February 2021.

Related

Uses · MITRE ATT&CK (28)

  • T1620 Reflective Code Loading technique
  • T1555.004 Windows Credential Manager sub-technique
  • T1588.002 Tool sub-technique
  • T1573 Encrypted Channel technique
  • T1132.002 Non-Standard Encoding sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.006 Python sub-technique
  • T1087.003 Email Account sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1560 Archive Collected Data technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1055.002 Portable Executable Injection sub-technique
  • T1217 Browser Information Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1016 System Network Configuration Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1049 System Network Connections Discovery technique
  • T1055 Process Injection technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1113 Screen Capture technique

Referenced by MITRE ATT&CK · uses (1)

References