Search/Lizar
● Malware

Lizar

Lizar is a modular remote access tool written using the .NET Framework that shares structural similarities to Carbanak. It has likely been used by FIN7 since at least February 2021.

View graph Watch Export
Indicators tracked
0
Intelligence Reports40
40 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
29 relationships
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1140: Deobfuscate/Decode Files or Information
source
T1055: Process Injection
source
T1620: Reflective Code Loading
source
T1087.003: Email Account
source
T1560: Archive Collected Data
source
T1555.003: Credentials from Web Browsers
source
T1217: Browser Information Discovery
source
T1003.001: LSASS Memory
source
T1016: System Network Configuration Discovery
source
T1049: System Network Connections Discovery
source
T1055.002: Portable Executable Injection
source
T1057: Process Discovery
source
T1059.001: PowerShell
source
T1588.002: Tool
source
T1027: Obfuscated Files or Information
source
T1573: Encrypted Channel
source
T1095: Non-Application Layer Protocol
source
T1518.001: Security Software Discovery
source
T1059.006: Python
source
T1059.003: Windows Command Shell
source
T1555.004: Windows Credential Manager
source
T1132.002: Non-Standard Encoding
source
T1105: Ingress Tool Transfer
source
T1055.001: Dynamic-link Library Injection
source