Lizar

ATP Sandbox Adv. Heuristics

Description

Lizar is a modular remote access tool written in .NET that shares structural similarities with Carbanak, and FIN7 has likely used it since at least February 2021.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

DiceLoaderDiceloader

MITRE ATT&CK techniques

28 techniques across 7 tactics.

TA0042 Resource Development

T1588Obtain Capabilities
- T1588.002Tool

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.006Python
- T1059.001PowerShell
T1106Native API

TA0005 Stealth

T1027Obfuscated Files or Information
T1055Process Injection
- T1055.001Dynamic-link Library Injection
- T1055.002Portable Executable Injection
T1140Deobfuscate/Decode Files or Information
T1620Reflective Code Loading

TA0006 Credential Access

T1003OS Credential Dumping
- T1003.001LSASS Memory
T1555Credentials from Password Stores
- T1555.004Windows Credential Manager
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1082System Information Discovery
T1087Account Discovery
- T1087.003Email Account
T1217Browser Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1113Screen Capture
T1560Archive Collected Data

TA0011 Command and Control

T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.002Non-Standard Encoding
T1573Encrypted Channel

Associated groups

G0046FIN7

Alert name variants

Alert Name	Engine
Win64.Trojan.Diceloader	ATP Sandbox Adv. Heuristics
Win64.Trojan.DiceLoader	ATP Sandbox Adv. Heuristics

Related families

Cobalt Strike Empire InvisiMole QakBot NETWIRE

References