EvilAI

“EvilAI… distributed through malicious advertisements, SEO manipulations, and social media links.”

Hosting them on newly registered websites that imitate vendor portals or tech solution pages Using malicious advertisements, SEO manipulation, and promoted download links on forums and social media Encouraging users to download tools for productivity, document handling, or AI-enhanced capabilities

The attacker utilized Windows Management Instrumentation (WMI) to determine if Microsoft Edge or Google Chrome was running on the system.

This allows me to look at the scheduled task that gets dropped, as well as the JS file, and some of the workings of this application.

The malware establishes persistence by creating a scheduled task named sys_component_health_{UID}, disguised to look like a legitimate Windows process.

This routine serves as EvilAI’s primary mechanism for executing arbitrary system commands, scripts, or additional malicious payloads, providing full remote command execution capabilities under the control of the C&C server.

powershell.exe "Get-WmiObject Win32_Process | Where-Object { $_.Name -eq 'chrome.exe' }"

cmd.exe /c start "" /min "C:\Users\<user>\AppData\Roaming\NodeJs\node.exe" "C:\Users\<user>\AppData\Local\TEMP\[GUID]of.js"

executing a JavaScript payload stored in the user’s temporary directory

“…processing JSON payloads for… process execution…”

This allows me to look at the scheduled task that gets dropped, as well as the JS file, and some of the workings of this application.

The malware establishes persistence by creating a scheduled task named sys_component_health_{UID}, disguised to look like a legitimate Windows process.

The registry operations dispatcher processes arrays of commands received from the C&C server... routing commands based on the Action field (3 for add, 4 for delete).

persistence is strengthened by adding an entry to the Windows Registry Run key, which ensures that PDFEditorUpdater executes at user logon

This allows me to look at the scheduled task that gets dropped, as well as the JS file, and some of the workings of this application.

The malware establishes persistence by creating a scheduled task named sys_component_health_{UID}, disguised to look like a legitimate Windows process.

persistence is strengthened by adding an entry to the Windows Registry Run key, which ensures that PDFEditorUpdater executes at user logon

The malware employs multiple layers of code obfuscation to hinder analysis and evade detection, primarily through control flow flattening.

The deobfuscated JS, ends with an EVAL, which will run any JS returned from the server after the check-in runs.

A common and highly effective evasion tactic used by EvilAI is making malicious software appear legitimate at every level.

the deletion routine constructs paths and executes reg delete via spawnSync with the /f force flag, removing specified values while returning status codes to indicate success or failure, enabling the malware to perform cleanup or anti-forensics operations on the system

The malware uses advanced anti-analysis techniques that significantly hinder static code analysis and increase reverse engineering difficulty.

The registry operations dispatcher processes arrays of commands received from the C&C server... routing commands based on the Action field (3 for add, 4 for delete).

To enhance credibility, attackers often abuse digital signatures and trusted certificates. Some groups go so far as to obtain or misuse code-signing certificates, granting their malware an additional layer of trust by making it appear as “verified” software.

“Many carry valid digital signatures from newly registered entities… lending an air of legitimacy that bypasses initial scrutiny.”

Credential data duplication from browser profiles

return (await _0x324dc7(_0x26c49f.HKLM, "Software\\Microsoft\\Cryptography", "MachineGuid")).value;

the attacker utilized Windows Management Instrumentation (WMI) to determine if Microsoft Edge or Google Chrome was running on the system

Get-WmiObject Win32_Process | Where-Object { $_.Name -eq 'chrome.exe' }

the attacker performed a series of registry queries to enumerate installed software

The processor expands Windows environment variables ... and writes the resulting binary content to the specified path

The malware uses advanced anti-analysis techniques that significantly hinder static code analysis and increase reverse engineering difficulty.

the attacker performed a series of registry queries to enumerate installed software, the majority of which were security and AV products

the attacker created copies of both the “Web Data” and “Preferences” files from Microsoft Edge and Google Chrome browser profiles

Once commands are decrypted, the malware executes them, reports the results back to the C&C via HTTPS POST, and continues the cycle to maintain ongoing control.

It processes arrays of download command objects... and calls the low-level helper for each download to retrieve files from remote URLs and save them locally.

The Payload can be decoded in cyberchef, it's Base64 decode, send to HEX, use the first 16 bytes as an XOR key, then take the remaining HEX, (From HEX) and apply the XOR key.

EvilAI employs AES-256-CBC encryption to secure JSON payloads sent to its C&C server

“…enumerate browser processes like Microsoft Edge and Chrome, terminating them to facilitate credential theft…”

Following process inspection and security product enumeration, the adversary forcibly terminated the Microsoft Edge and Chrome browser, likely to free files for credential theft or to avoid user detection