AuditCred

MITRE ATT&CK: S0347 View on attack.mitre.org

Aliases: Roptimizer, AuditCred

First seen: 2018-01-01 00:00:00
Malware type: trojan
Family: Malware family
Operating systems: windows
Profile updated: 2026-07-07 14:49:52

Targeted industries: financial-services government-and-public-sector

Targeted regions: country_code:kr country_code:us

Context

AuditCred is a malicious DLL that has been used by Lazarus Group during their 2018 attacks.

Detection coverage

230 Sigma rules

Malware & tools used

File and Directory Discovery (attack-pattern)
Proxy (attack-pattern)
File Deletion (attack-pattern)
Process Injection (attack-pattern)
Ingress Tool Transfer (attack-pattern)
Windows Command Shell (attack-pattern)
Deobfuscate/Decode Files or Information (attack-pattern)
Windows Service (attack-pattern)
Encrypted/Encoded File (attack-pattern)

Used by threat actors

Lazarus Group (threat-actor)

Reports & references

Trend Micro — Lazarus Continues Heists Mounts Attacks On Financial Organizations In Latin America (report)
MITRE ATT&CK — S0347 (report)

External references