Malware
BLINDINGCAN
aka AIRDRY · ZetaNile
BLINDINGCAN is a remote access trojan that communicates with its C&C server via HTTP(S).
BLINDINGCAN, also known as AIRDRY, ZetaNile, is a Windows malware family operated by Lazarus Group.
Background
BLINDINGCAN is a remote access trojan whose communication with its C&C server runs over HTTP(S). For encrypting and decrypting both its configuration and network traffic, it relies on a (custom) RC4 or AES implementation. The trojan reports details about the compromised host, including the computer name, IP address, Windows product name, and processor name. Roughly 30 commands are supported, covering filesystem operations, basic process management, command line execution, file exfiltration, configuration updates, and retrieving and running further payloads from the attackers' C&C; these commands are referenced by 16-bit integers that begin at 0x2009 and increment up to 0x2057, with certain indices left unused. Its HTTP POST requests employ a variety of parameter names commonly tied to bulletin board system web servers, such as bbs, article, boardid, s_board, page, and idx_num. The binary also carries distinctive RTTI symbols including ".?AVCHTTP_Protocol@@", ".?AVCFileRW@@", and ".?AVCSinSocket@@". As a primary payload across numerous Lazarus operations, BLINDINGCAN featured prominently in the Operation DreamJob campaigns conducted from 2020 to 2022.
Source: Malpedia (Fraunhofer FKIE).