Loading malware…
ARTFULPIE is a Windows malware variant attributed to North Korean government cyber activity tracked as HIDDEN COBRA and commonly associated with the Lazarus Group. It functions as a downloader and launcher that retrieves an additional DLL payload from a hard-coded network location, manually maps that payload into memory, and executes it by invoking the DLL entry point. This behavior makes ARTFULPIE a lightweight staging component used to deliver and run follow-on malware without relying on standard library loading mechanisms.
The malware is characterized by in-memory loading and execution of a DLL-based payload, which supports defense evasion and post-compromise payload deployment. Reporting also describes ARTFULPIE as responsible for retrieval and injection of a DLL payload, reinforcing its role as an execution facilitator rather than a full-featured standalone implant. It has been documented in campaigns spanning at least from 2017 onward as part of a broader Lazarus toolset.
ARTFULPIE targets Microsoft Windows systems and has been identified as a PE32 executable. It is best classified as a downloader because its primary confirmed purpose is to fetch and execute additional malicious code. High-confidence reporting links it to North Korean intrusion activity, but available information does not establish a specific initial infection vector for ARTFULPIE itself. No industry-specific targeting can be stated for ARTFULPIE alone with high confidence from the available facts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ARTFULPIE is responsible for retrieval and injection of a DLL-based payload. The malware contains a hard-coded URL from which to download the additional code (193[.]56[.]28[.]103).
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Downloads the hardcoded URL hxxp[:]//193[.]56[.]28[.]103:88/xampp/thinkmeter[.]dll into memory using the user-agent string: "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)".
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Lazarus/Hidden Cobra downloader/injector used to retrieve additional DLL-based payloads from a hardcoded location and inject them for follow-on execution.
Downloader and launcher tool set.
Downloader/loader implant attributed in the report to North Korean government activity. It downloads a DLL from a hardcoded URL, loads the DLL manually into its own process memory, and executes the DLL entry point in memory.
A Lazarus implant that works by obtaining and injecting DLL payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.