Analysis Summary

Emotet has recently been found to increase cyber activities after a short period of dormancy. Fresher IoCs are being retrieved every day. Emotet is a banking trojan turned into a malware loader that drops other payloads after initial infection, often Qbot. Emotet Malware is constantly being detected in the wild, targeting organizations from multiple sectors and countries, primarily spread through spam emails (malspam). The infection may arrive via a malicious script, macro-enabled document files, or lnk. Emotet emails may contain familiar branding designed to look like legitimate emails. Emotet operators usually try to get users to click the malicious files using lures like “YourInvoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. Emotet has gone through a few iterations. Early versions arrived as malicious JavaScript files. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers. Lately, Emotet infections have been used to distribute other malware like Qakbot. So these can be multi-stage attacks that bundle other malware with Emotet.

Impact

• Credential Theft
• Information Theft
• Financial Loss

Indicators of Compromise

MD5

• d09a466039ffe16e231a202bd6259db8
• 07a65d20c622c4da0027e6d1069903f3
• a858c38f9215194bd736730ba1ccbb49

SHA-256

• 591d32aeae0554f744df8843727e794d33495ff0a4b90a9f7861ab526988ded7
• f10052e10c319749ccd6aead272df3e831e4d4224a32ac589e1a577db38e2b70
• ef246ba750950b98b7b42d1251a6b0846457d2ecf656b495e82baf09911ddafd

SHA-1

• a625728ec40bd353b79913bed4dee0c297467d3d
• 1f3fba680895890258bacf136afc9db655a53571
• 4611026c4d9b2c5f7288c25a3b9975e1c50da499

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.
• Passwords - Ensure that general security policies include implementing strong passwords, correct configurations, and proper administration of security policies.
• Admin Access - Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
• WAF - Web defacement must be stopped at the web application level. Therefore, set up a Web Application Firewall with rules to block suspicious and malicious requests.
• Patch - Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Secure Coding - Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• 2FA - Enable two-factor authentication.
• Antivirus - Enable antivirus and anti-malware software and update signature definitions promptly. Using a multi-layered protection is necessary to secure vulnerable assets.