LightlessCan

Description

(ESET) The most interesting payload used in this campaign is LightlessCan, a successor of the group’s flagship HTTP(S) Lazarus RAT named BLINDINGCAN. LightlessCan is a new complex RAT that has support for up to 68 distinct commands, indexed in a custom function table, but in the current version, 1.0, only 43 of those commands are implemented with some functionality. The remaining commands are present but have a formal implementation in the form of placeholders, lacking actual functionality. The project behind the RAT is definitely based on the BlindingCan source code, as the order of the shared commands is preserved significantly, even though there may be differences in their indexing.

Names

Name
LightlessCan

Category

Malware

Type

• Backdoor

Information

• https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/

Malpedia

• https://malpedia.caad.fkie.fraunhofer.de/details/win.lightlesscan

Other Information

Uuid

38856463-ecc8-498e-8117-04f4026acae0

Last Card Change

2024-01-17