EvilExtractor

FortiGuard Labs observed this malware in a phishing email campaign on 30 March... Initial Access The phishing email with the malicious attachment is shown in Figure 2. It is disguised as an account confirmation request.

The phishing email with the malicious attachment is shown in Figure 2. It is disguised as an account confirmation request. The attacker also tricks the victim by using an Adobe PDF icon for the decompressed file.

once loaded, it begins to leverage PowerShell malicious activities... After decrypting the pyc file, we get the primary code of EvilExtractor. It is a PowerShell script

The execution file is a Python program packaged by PyInstaller... After passing the environment check, EvilExtractor downloads three components... These files are also Python programs that are obfuscated using PyArmor.

the “PYARMOR” string in its main code file “contain.pyc”... is an obfuscating tool for Python script that makes the malware harder to be analyzed and detected.

It usually pretends to be a legitimate file, such as an Adobe PDF or Dropbox file... The attacker also tricks the victim by using an Adobe PDF icon for the decompressed file.

It contains the following modules: ... Clear log ... If not, it uses the following command to delete the data in PSReadline and terminate

It contains Base64-encoded data, which is a PowerShell script.

It also contains environment checking and Anti-VM functions... It then compares the product model to see if it matches any of the following: VirtualBox, VMWare, Hyper-V... It also checks the victim’s hostname against 187 names from VirusTotal machines or other scanner/virtual machines

It first checks whether the system’s date is between 2022-11-09 and 2023-04-12... It then compares the product model... It also checks the victim’s hostname against 187 names from VirusTotal machines or other scanner/virtual machines

The second file is “Confirm.zip”. It is a key logger that saves data in the “KeyLogs” folder.

After uploading browser cookies, browser history and cached passwords from Chrome, Firefox and Edge to the “1-Password-Cookies” directory

It can extract cookies from Google Chrome, Microsoft Edge, Opera, and Firefox. It also collects browser history and passwords

It can extract cookies from Google Chrome, Microsoft Edge, Opera, and Firefox. It also collects browser history and passwords

EvilExtractor also collects system information by PowerShell script, shown in Figure 9.

The stealer also exfiltrates files with mpeg, docx, jpeg, pptx, zip, avi and rar extensions from the victim PC to the “3-Files” directory on the FTP server. The directory structure of the victim’s PC is maintained on the FTP server

It also contains environment checking and Anti-VM functions... It then compares the product model to see if it matches any of the following: VirtualBox, VMWare, Hyper-V... It also checks the victim’s hostname against 187 names from VirusTotal machines or other scanner/virtual machines

It first checks whether the system’s date is between 2022-11-09 and 2023-04-12... It then compares the product model... It also checks the victim’s hostname against 187 names from VirusTotal machines or other scanner/virtual machines

The contents of this text file looks something like this: Public IP: [redacted] Location: [lat],[long]

The second file is “Confirm.zip”. It is a key logger that saves data in the “KeyLogs” folder.

It also uses the command “CopyFromScreen” to capture a screenshot.

This stealer collects credentials and files of interest from the victim’s computer and exfiltrates them to an FTP server. It is designed to autonomously collect and exfiltrate data rather than receiving commands from an operator through a command-and-control channel.

The last file, “MnMs.zip”, is a webcam extractor.

It downloads “zzyy.zip” from evilextractor[.]com... Figure 15 shows it leverages “7za.exe” to encrypt files with the parameter “-p”, which means zipping files with a password.

After passing the environment check, EvilExtractor downloads three components from http://193[.]42[.]33[.]232 used for stealing data.

Twenty seconds later an FTP connection is established to 89.116.53.55 on TCP port 21... On the FTP server EvilExtractor creates a directory named after the country and hostname of the victim's PC