Romeos
Description
(Novetta) A large portion of the Lazarus Group’s RAT collection stems from a common core, Romeo-CoreOne (R-C1); the individual families that use R-C1 need only provide the scaffolding to support the R-C1 code. At a minimum, each family that is built upon R-C1 must provide an interface to their specific communications abstraction and a method by which to activate the R-C1 functionality.
The general flow of execution for families that use R-C1 is as follows:
- Dynamically load API functions
- Perform any configuration management tasks that the family may require (e.g., loading the configuration, opening listening ports, establishing persistence)
- Establish a communication channel with controlling endpoint
- Pass off the channel to the R-C1 component
There are five known families that are based on, or that incorporate, R-C1 (Figure 2-1): RomeoAlfa, RomeoBravo, RomeoCharlie, RomeoHotel, and RomeoNovember. In addition to the four families having commonality through the use of R-C1, two of the families, RomeoAlfa and RomeoHotel, share the distinctive fake TLS communication scheme and use the Caracachs encryption scheme as their underlying communication encryption. RomeoBravo, RomeoCharlie, and RomeoNovember use DNSCALC-style encoding for communication encryption.
Names
| Name |
|---|
| Romeos |
| RomeoCore |
| Romeo-CoreOne |
| R-C1 |
Category
Malware
Type
- Backdoor
- Info stealer
Information
Malpedia
Other Information
Uuid
f9e598ab-266d-4460-9d22-d945de9498d3
Last Card Change
2020-04-23