EvilExtractor Malware Seeks to Steal Data

EvilExtractor is a malicious tool that targets Windows operating systems to extract data and files from endpoint devices. Its modules operate through an FTP service and were developed by a company named Kodex, which claims it is an educational tool. However, research by FortiGuard Labs shows that cybercriminals are actively using it to steal information.

Malicious activity related to evilextractor.com increased significantly in March 2023. FortiGuard Labs observed this malware in a phishing email campaign on 30 March and traced it back to the samples included in their report. The malware is disguised as a legitimate file such as an Adobe PDF or Dropbox file, but once opened, it initiates PowerShell malicious activities. The malware also contains functions that check the environment and such that check for virtualization. The malware's main goal is to steal browser data and information from compromised systems and then funnel it to the attackers.

According to Fortinet's report, the attacks they observed started with a phishing email that contained a compressed executable attachment disguised as a legitimate PDF or Dropbox file. Once opened, it launches a .NET loader that uses an encoded PowerShell script to launch an EvilExtractor executable. Upon the first launch, the malware checks the system's local time and hostname to see if it is running in a virtual environment or sandbox, in which case it will exit.

EvilExtractor includes three additional Python components: "KK2023.zip," "Confirm.zip," and "MnMs.zip." The first program extracts cookies, browsing history, and saved passwords from Google Chrome, Microsoft Edge, Opera, and Firefox, among other programs. The other module is a key logger that records keystrokes and saves them in a local folder. The third file is a webcam extractor that can quietly turn on the webcam, capture video or images, and upload the capture to the attacker's FTP server. The malware also exfiltrates many document and media file types from the Desktop and Downloads folders, captures screenshots, and sends all stolen data to its operators. Additionally, the 'Kodex ransomware' module is nested in the loader and, if activated, downloads an additional file ("zzyy.zip") from the product's website to create a password-protected archive containing the victim's files.

How Can Threat Actors Spread Malware Similar to EvilExtractor?

Threat actors can spread malware similar to EvilExtractor using various tactics, such as:

• Phishing Emails: Attackers can create phishing emails that appear to be from a trusted source, such as a bank or a popular online service, and include attachments or links to malicious files disguised as legitimate files, like PDFs or Dropbox files. Once the victim opens the file, the malware can be installed on their system.
• Malvertising: Attackers can also spread malware through malvertising, which involves creating malicious ads that appear on legitimate websites. When a user clicks on the ad, it redirects them to a website that installs malware on their system.
• Watering Hole Attacks: In this type of attack, attackers target a specific website that is likely to be visited by their intended victims. They infect the website with malware, and when the victim visits the site, their system is infected with malware.
• Drive-by Downloads: Attackers can also use drive-by downloads to install malware on a victim's system. This type of attack involves injecting malicious code into legitimate websites. When a user visits the infected website, the malicious code is downloaded onto their system without their knowledge or consent.
• Social Engineering: Attackers can use social engineering tactics to trick victims into installing malware on their systems. For example, they can create fake software updates or antivirus programs that are actually malware in disguise.

To protect against these types of attacks, it's essential to practice good cybersecurity hygiene, such as keeping your system and software up to date, using strong passwords, and being cautious when opening email attachments or clicking on links.