The FortiGuard Web Filtering Service blocks the malicious URL and IP address. Customers running current AntiVirus updates are protected. The FortiGuard AntiVirus service is supported by FortiGate, FortiMail, FortiClient, and FortiEDR, and the Fortinet AntiVirus engine is a part of each of those solutions. The malware described in this report are detected and blocked by FortiGuard Antivirus as: This article will examine the initial attack method used to deliver EvilExtractor and its functions. The developer released its project in October 2022 (Figure 1) and has kept updating it to increase its stability and strengthen its module. We recently reviewed a version of the malware that was injected into a victim’s system and, as part of that analysis, identified that most of its victims are located in Europe and America. Its primary purpose seems to be to steal browser data and information from compromised endpoints and then upload it to the attacker’s FTP server. It also contains environment checking and Anti-VM functions. It usually pretends to be a legitimate file, such as an Adobe PDF or Dropbox file, but once loaded, it begins to leverage PowerShell malicious activities. FortiGuard Labs observed this malware in a phishing email campaign on 30 March, which we traced back to the samples included in this blog.

However, research conducted by FortiGuard Labs shows cybercriminals are actively using it as an info stealer.īased on our traffic source data to the host, evilextractorcom, malicious activity increased significantly in March 2023. It was developed by a company named Kodex, which claims it is an educational tool. It includes several modules that all work via an FTP service. Impact: Controls victim’s device and collects sensitive informationĮvilExtractor (sometimes spelled Evil Extractor) is an attack tool designed to target Windows operating systems and extract data and files from endpoint devices.

Download forti