Evilnum__2020__Prevailion_Blog_Phantom_in_the_Command_Shell.pdf

Prevailion observed a targeted campaign against financial organizations using EVILNUM variants (v3.6 and v4.0) delivered via Google Drive-hosted ZIPs with trojanized .lnk files; a headless JavaScript “Phantom” agent executes on Windows to enumerate systems, adapt persistence and C2 selection based on detected antivirus, steal cookies and exfiltrate data, and supports fetching secondary payloads. The report provides delivery and loader details, C2 retrieval via GitLab/DigitalPoint, C2 IP addresses, registry persistence changes, multiple file/script hashes, actor-created folders, and MITRE ATT&CK mappings.