Threat actor TA4563 has been using Evilnum backdoor to target several European financial and investment entities, specifically the DeFi industry, for nearly two years.
How does Evilnum work?
- As a method of testing the efficacy of the delivery methods, the updated version of Evilnum employs a diverse mix of ISO, Microsoft Word, and Shortcut (LNK) files.
- To avoid detection, the malware includes multiple components that modify infection paths based on detected antivirus software.
- Evilnum can be used for reconnaissance, data theft, and additional payload deployment.
Campaign details
2021
- The first campaign, which occurred in December 2021, attempted to deliver word documents used to install the updated version of the Evilnum backdoor.
- The phishing messages install several LNK loader components on the domain, which then uses wscript to load the Evilnum payload and a JavaScript payload.
Early 2022
- This time, the group attempted to deliver multiple OneDrive URLs, each with an ISO or LNK attachment.
- The actor used monetary inducements to persuade the recipients to launch the payload.
- Following campaigns included the direct delivery of a compressed LNK file as an additional attempt to install Evilnum.
Mid 2022
TA4563 delivered Microsoft Word documents in mid-2022 campaigns in an attempt to download a remote template.
Evilnum details
- Previous versions of Evilnum include both a JavaScript component and a C# component of the backdoor.
- The backdoor restricts downloads to only one IP address per campaign to ensure that only the target can retrieve the malware.
- .LNK loader is responsible for executing PowerShell via cmd.exe, which then downloads two different payloads from the initial host.
Payload details
- The first payload is responsible for executing two PowerShell scripts.
- The first is used to decrypt a PNG and restart the infection chain.
- The second, larger PowerShell script loads C# code dynamically and sends screenshots to a C2 server.
- The second payload contains two encrypted blobs in which the first one is decrypted to an executable and the second to a TMP file.
Conclusion
TA4563 has restricted its attempts to compromise the victims using various methods of delivery. Evilnum malware and the TA4563 group pose a risk to financial organizations, and as per the latest analysis, the malware is under active development.