Severity
High
Analysis Summary
Emotet is a banking trojan usually distributed via email spam. The malicious word documents are now increasingly delivered within a password-protected zip-file. This is done in order to prevent researchers to automatically detect and extract Emotet’s IoCs. Until recently, Emotet was rarely distributed with a password protected archive. Most spams featured a link to an office document or had it attached directly to the email. There have been just a few zip-file occurrences at the beginning of September. Recently, significant volume of emails containing zips with Emotet have been reported. Emotet is currently using random first names to create authentic reply chains, with an empty “Original Message” footer. The first lines of the email will now reference an encrypted zip file archive and provide the password, instead of just mentioning the document as before. Emails have been spotted in several different languages just like before.
Impact
- Theft of sensitive information
- Financial loss
Indicators of Compromise
MD5
- 4473e1406415a70312e54713b3ee5461
- 8ab198ee39b8dceebf833581222d4a2e
- db928ce2ca31b422d4e5785932fc8f22
SHA-256
- 003f19a4d9c1af6c87b437385d5274bb39fc4499264dbde7dcf76f5db1f351fa
- 2f345073e3bb0169d18ee8fe2dc052679777afa5f862fe6dc895688a8c4958d0
- 67824f7d30de00f42e6113fd77722452ace44733dddd60a0fba1c54567aefa1f
SHA1
- 187d38f6674c38a4c968fc3ea25ccce89f111f59
- a9f495d3b70870b023fc723cfb0afbd56cd7b75d
- 688b349c1f623c7d10a6a3f9141bffedbd6d519e
Source IP
- 71[.]72[.]196[.]159
- 190[.]192[.]39[.]136
URL
- http[:]//personalizzabili[.]com/images/lvyX7QK/
- http[:]//sasystemsuk[.]com/index_files/j9b/
- http[:]//bigtreestudios[.]org/temporary/cpmNZIXomC/
Remediation
- Block the threat indicators at their respective controls.
- Do not download unexpected password-protected zip-files coming from unknown sources.