ESET EvilNum July 2020

More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.

More_eggs has used cmd.exe for execution.

Evilnum has used malicious JavaScript files on the victim's machine.

Evilnum has deleted files used during infection.

Evilnum can deploy additional components or tools as needed.

EVILNUM can download and upload files to the victim's computer.

Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.

EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines.

Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.

Evilnum can steal cookies and session information from browsers.

EVILNUM can achieve persistence through the Registry Run key.

Evilnum has used PowerShell to bypass UAC.

Evilnum can collect email credentials from victims.

Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.