Evil Extractor Targets Windows Devices to Steal Sensitive Data

The attack tool recognised as Evil Extractor and developed by a company named Kodex as an “educational device,” has been applied by menace actors to target Windows-primarily based equipment.

The statements appear from Fortinet security researchers and were being described in an advisory published on Thursday.

“[We] observed this malware in a phishing email campaign [disguised as account confirmation requests] on 30 March, which we traced again to the samples bundled in this blog site. It commonly pretends to be a reputable file, such as an Adobe PDF or Dropbox file, but once loaded, it commences to leverage PowerShell malicious activities,” the corporation wrote.

Browse far more on phishing malware below: DEV-1101 Updates Open up Supply Phishing Package

Evil Extractor operates as a result of many modules that depend on a File Transfer Protocol (FTP) services.

Further more, Evil Extractor consists of natural environment checking as nicely as anti-virtual equipment (VM) and VirusTotal abilities intended to stay away from detection. The malware also has a ransomware operate named “Kodex Ransomware.”

“We a short while ago reviewed a edition of the malware that was injected into a victim’s technique and, as section of that analysis, identified that most of its victims are located in Europe and America,” Fortinet stated.

According to the advisory, the developer unveiled the malware in Oct 2022 and kept updating it to enhance its steadiness and reinforce its destructive abilities.

“EvilExtractor is being used as a complete details stealer with numerous destructive characteristics, which includes ransomware. Its PowerShell script can elude detection in a .NET loader or PyArmor,” reads the specialized generate-up. “Users must be conscious of this new info stealer and carry on to be cautious about suspicious mail.”

The publication of the advisory, which also bundled indicators of compromise for the malware, comes weeks immediately after Open up Textual content Cybersecurity professionals warned versus a sizeable surge in HTTPS phishing internet sites.

Some parts of this article are sourced from:
www.infosecurity-journal.com