Rewterz Threat Alert – Emotet – Active IOCs

Severity

High

Analysis Summary

Emotet was initially discovered in 2014 when it infected clients of German and Austrian institutions. Emotet serves as a downloader for other malware variants like TrickBot, QakBot, and IcedID. Phishing attempts are the most common way to propagate emotet trojan, which employs an email with malicious links or Macro-embedded Microsoft Word files. It has mostly been used to attack the banking industry. Emotet can launch several malware payloads depending on the target system after deployment. Emotet is frequently used as a downloader for other malware and is a particularly common delivery method for banking Trojans such as Qakbot and TrickBot. Emotet can steal data such as saved user passwords on the browser by eavesdropping on network traffic. Its modules focus on credential theft, email theft, and spamming.

Emotet has recently found in increased cyber activities after a short period of dormancy. Fresher IoCs are being retrieved everyday. Emotet is a banking trojan turned into a malware loader that drops other payloads after initial infection, often Qbot. Emotet Malware is constantly being detected in the wild, targeting organizations from multiple sectors and countries, primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate emails. Emotet operators usually try to get users to click the malicious files by using lures like “YourInvoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. Emotet has gone through a few iterations. Early versions arrived as malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers. Lately, Emotet infections have been used to distribute other malware like Qakbot. So these can be multi-stage attacks that bundle other malware with emotet.

Most recently, Emotet malware was observed spamming XLS and zipped XLS.

Impact

• Credential Theft
• Information Theft
• Financial Loss

Indicators of Compromise

MD5

• 18252d898a785e916760be3e63c29a78

SHA-256

• 8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed

SHA-1

• 769301632d80a6c5996e7f9514786e79d044db17

URL

• http[:]//www[.]spinbalence[.]com/admin3693/Z6WQpmNRNj6041fU2zpt/
• http[:]//kabaruntukrakyat[.]com/wp-content/ES/
• https[:]//chobemaster[.]com/INFECTED/LEdXM4gdwN4mgnlC/
• http[:]//cngst[.]com/data/fXWpDbJ3KwAybE/

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment