Lazarus Campaign Uses Remote Tools, RATANKBA, and More

Trend Micro Research

We analyzed a new RATANKBA variant that uses a PowerShell script instead of its more traditional PE executable form. In this entry, we provide in-depth analysis of the malware, as well as a detailed examination of its remote controller.