Evilnum__2020__No_Rest_for_the_Wicked_Evilnum_Unleashes_PyVil_RAT.pdf

## Executive summary Cybereason Nocturnus documents Evilnum's evolved campaign targeting FinTech organizations using spearphishing with KYC-themed attachments: an LNK dropper writes a JS dropper that installs a scheduled-task-based chain (ddpp.exe → fplayer.exe) which fetches and executes a py2exe-packed Python RAT called PyVil. PyVil supports keylogging, screenshots, credential theft (including a custom LaZagne module), remote shell, plugin/module updates via RC4-encrypted HTTP POSTs to multiple domains, and uses modified legitimate executables for stealth; the report includes detailed TTPs and IOCs for detection and response.