If it were able to get through Evernote, the malware then uses login credentials programmed in its code to retrieve malicious codes saved in notes on the service.ĭuring the time of testing, the malware was unable to log in, possibly due to Evernote’s service-wide password reset before the incident.

DLL file then starts the actual backdoor routines.īKDR_VERNOT.A then connects to the note-taking service, Evernote, using the link as its referrer. DLL component then injects itself in a legitimate process, specifically Windows Explorer. DLL file or component that is formatted in the same way as the computer’s temporary directory or folder.

What happens when BKDR_VERNOT.A is executed on a system? It may also be dropped by other malware on user systems. Similar to various malware, BKDR_VERNOT.A can get into a computer system when users visit malicious sites, unknowingly downloading the said malware. It also reminds of the TSPY_SPCESEND.A malware, which uses file hosting website, Sendspace, to store stolen data. The Evernote incident is reminiscent of the Google Docs incident, when BKDR_MAKADOCS.JG used as proxy for its command-and-control (C&C) servers. In doing so, cybercriminals hope to evade detection and accomplish their goals. In a reported incident, cybercriminals took advantage of note-taking service, Evernote, thus demonstrating their continued efforts to use legitimate services for malicious purposes.

Evernote login hidden