PyVil RAT

The initial infection vector of Evilnum typically begins with spear phishing emails, with the goal of delivering ZIP archives that contain LNK files masquerading as photos of different documents such as driving licenses, credit cards, and utility bills.

Unlike previous versions where the malware used the Run registry key for persistence, in this new version, a scheduled task named “Dolby Selector Task” for ddpp.exe is created instead.

The PyVil RAT has several functionalities including: Keylogger Running cmd commands Taking screenshots

When the LNK file is executed, as in previous versions, a JavaScript file is written to disk and executed, replacing the LNK file with a PDF.

Once an LNK file is opened, it deploys the JavaScript Trojan, which in turn replaces the LNK file with a real image file, making this whole operation invisible to the user.

Unlike previous versions where the malware used the Run registry key for persistence, in this new version, a scheduled task named “Dolby Selector Task” for ddpp.exe is created instead.

Unlike previous versions where the malware used the Run registry key for persistence, in this new version, a scheduled task named “Dolby Selector Task” for ddpp.exe is created instead.

The Python code inside the py2exe is obfuscated with extra layers, in order to prevent decompilation of the payload using existing tools.

Modified versions of legitimate executables employed in an attempt to remain undetected by security tools.

The first piece of code decodes and decompresses the second layer of Python code.

In Cybereason, we see the attempted credential dump by the payload.

PyVil RAT possesses different functionalities, and enables the attackers to exfiltrate data, perform keylogging and the taking of screenshots

The main goal of the group is to spy on its infected targets and steal information such as passwords, documents, browser cookies, email credentials and more.

This Python module is a custom version of the LaZagne Project which the Evilnum group has used in the past. The script will try to dump passwords and collect cookie information to send to the C2.

The script will try to dump passwords and collect cookie information to send to the C2.

Collecting information such as: Anti-virus products installed USB devices connected Chrome version

This encrypted data contains a Json of different data collected from the machine and configuration: ... host Hostname uname User name ia Is user admin wv Windows version dt Current date and time avs List of installed anti-virus products

Collecting information such as: Anti-virus products installed USB devices connected Chrome version

PyVil RAT possesses different functionalities, and enables the attackers to exfiltrate data, perform keylogging and the taking of screenshots

PyVil RAT possesses different functionalities, and enables the attackers to exfiltrate data, perform keylogging and the taking of screenshots

PyVil RAT’s C2 communications are done via POST HTTP requests and are RC4 encrypted using a hardcoded key encoded with base64.

PyVil RAT possesses different functionalities, and enables the attackers to exfiltrate data, perform keylogging and the taking of screenshots, and the deployment of more tools such as LaZagne in order to steal credentials.

PyVil RAT’s C2 communications are done via POST HTTP requests and are RC4 encrypted using a hardcoded key encoded with base64.

PyVil RAT’s C2 communications are done via POST HTTP requests and are RC4 encrypted using a hardcoded key encoded with base64.

This encrypted data contains a Json of different data collected from the machine and configuration