Malware
LPEClient
aka LPEClientTea
LPEClient is an HTTP(S) downloader that expects two command line parameters: an encrypted string containing two URLs (a primary and a secondary C&C server), and the path on the victim's file system to
LPEClient, also known as LPEClientTea, is a Windows malware family operated by Lazarus Group.
Background
LPEClient is an HTTP(S) downloader that takes two command-line arguments: an encrypted string holding two URLs (a primary and a secondary C&C server) and the location on the victim's filesystem where the fetched payload should be saved.
It transmits a thorough profile of the victim's environment, covering the computer name, processor type and count, computer manufacturer, product name, major and minor Windows versions, architecture, memory details, installed security software, and the ntoskrnl.exe version drawn from its version-information resource.
The malware relies on particular 32-bit constants to signal its execution state (0x59863F09 when it connects through the WinHTTP interface, 0xA9348B57 through WinINet) and to flag the type of HTTP request to the C&C servers (0xF07D6B34 for sending system information, 0xEF8C0D51 for requesting a DLL payload, 0xCB790A25 for confirming the DLL loaded successfully, 0xD7B20A96 for reporting the DLL's execution state). Finally, it locates and runs the CloseEnv export.
Source: Malpedia (Fraunhofer FKIE).