EvilAI Malware Campaign

MITRE Techniques

• [T1204] User Execution – Trojans masquerading as productivity tools are distributed via malicious websites, SEO manipulation, and social media promotions to trick users into installing the malicious apps (“trojans masquerading as productivity tools”).
• [T1547] Boot or Logon Autostart Execution – Persistence is achieved through scheduled tasks and registry Run key entries to ensure regular execution (“establishes persistence through scheduled tasks and registry Run key entries, ensuring daily execution at 10:51 AM and every four hours thereafter”).
• [T1059.007] Command and Scripting Interpreter: JavaScript – The malware executes AI-generated JavaScript in Node.js environments as the primary payload execution method (“AI-generated JavaScript code executed via Node.js”).
• [T1140] Deobfuscate/Decode Files or Information – Heavy obfuscation (control flow flattening, Unicode escape sequences, MurmurHash3 anti-analysis loops, meaningless variable names) is used to hinder analysis (“control flow flattening, Unicode escape sequences, and MurmurHash3-based anti-analysis loops that execute only once but appear infinite to static analysis tools”).
• [T1046] Network Service Discovery – The malware maintains encrypted C2 communications and processes JSON commands over a continuous command loop to discover and interact with remote services (“C2 infrastructure supports a continuous command loop, processing JSON payloads for file downloads, registry modifications, process execution, and script handling”).
• [T1036.005] Masquerading: Masquerade Task or Service – Malicious applications mimic legitimate software and use valid digital signatures from entities like App Interplace LLC and Byte Media Sdn Bhd to appear authentic (“carry valid digital signatures from newly registered entities like App Interplace LLC and Byte Media Sdn Bhd, lending an air of legitimacy”).
• [T1005] Data from Local System – The malware copies browser data files such as “Web Data” and “Preferences” from browser profiles to facilitate credential theft (“duplicating “Web Data” and “Preferences” files from browser profiles”).
• [T1112] Modify Registry – The malware modifies the Windows registry (Run keys) to maintain persistence (“establishes persistence through … registry Run key entries”).
• [T1105] Ingress Tool Transfer – The modular command handling allows downloading additional files and staging secondary payloads for further actions (“C2 supports commands for file downloads … acting as a stager, potentially deploying secondary infostealer payloads”).
• [T1573] Encrypted Channel – Communications with C2 are encrypted using AES-256-CBC with the instance ID as key to conceal traffic (“Network communications are secured with AES-256-CBC encryption, using the malware’s unique instance ID as a cryptographic key”).