Experts have detected dangerous new malware (opens in new tab) It crawls the Internet, steals sensitive data from victims, and even deploys ransomware in some cases.
Dubbed Evil Extractor, the malware was discovered by Fortinet cybersecurity researchers, who published their findings in a blog post. (opens in new tab) developed and distributed by a company called Kodex, and advertised as an “educational tool”.
“FortiGuard Labs observed this malware in a phishing email campaign on March 30th. This malware is traced back to the sample included in this blog,” said the researchers. “They typically disguise themselves as legitimate files, such as Adobe PDFs or Dropbox files, but once loaded, they begin leveraging PowerShell malicious activity.”
Evasion of detection These malicious activities include environmental analysis tools and infostealers. By doing this, the malware first checks that it is not deployed in a honeypot, then grabs as much sensitive information as possible from the endpoint and sends it to the attacker’s FTP server. It also has ransomware capabilities.
This tool called Kodex Ransomware downloads zzyy.zip from evilextractor.[.]com contains an executable called 7za.exe. This is an executable that uses the parameter “-p” to encrypt files. That is, the file is password zipped.
As usual, the malware next leaves a ransom note demanding $1,000 Bitcoin in exchange for the decryption key. I get a message saying “Otherwise the file will be permanently inaccessible”.
The malware is said to primarily target Western victims. “We recently investigated the version of the malware injected into the victim’s system and as part of that analysis confirmed that most of its victims are located in Europe and the United States,” Fortinet claims. doing.
We don’t know if the operators were able to successfully deploy the ransomware anywhere, or how many victims it may have taken to date.
Via: Info Security Magazine (opens in new tab)
websitebuildersnow
GIPHY App Key not set. Please check settings