This blog post describes the tools used by the Lazarus attack group. It is widely known that attackers use Windows commands and tools that are commonly known and used after intruding their target network. AdFind collects the information of clients and users from Active Directory. SMBMap is used to have their malware infect other hosts. It has also been observed that Responder-Windows was used to collect information in the network. Other tools are used for other purposes to create backdoors in the infected network using RDP, TeamViewer, VNC, and other applications.”]
Source: https://blogs.jpcert.or.jp/en/2021/01/Lazarus_tools.html