{"id":2436,"date":"2024-09-25T18:14:12","date_gmt":"2024-09-25T18:14:12","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2436"},"modified":"2025-07-29T03:43:47","modified_gmt":"2025-07-29T03:43:47","slug":"emotet-the-terror-returns","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/emotet-the-terror-returns\/","title":{"rendered":"Emotet: The Terror Returns"},"content":{"rendered":"
\n
\"\"\/<\/figure>\n<\/div>\n\n\n

After staying dormant since February 2020, Emotet<\/a> is back with full vengeance with significant surge in the variant\u2019s malware campaign during September 2020 and first week of Oct 2020. This has led US CERT CISA<\/strong> to release an official warning<\/a> about the Emotet Botnet\u2019s return.<\/p>\n\n\n\n

In this latest malspam campaign we analysed, the emails have a financial theme and come as a reply to a previous transaction by using fake payment remittance notices, invoice attachments or payment details. We also noticed that this time around it uses PowerShell macros in which users are tricked into opening an attached document to enable macros and trigger a PowerShell command which attempts to download Emotet from compromised sites.<\/p>\n\n\n\n

Furthermore, Emotet is now targeting legitimate websites that have WordPress themes by using the arbitrary file upload vulnerability in which file mime type is not checked by the server or code while attacker uploads backdoor script and the uploaded folder on given websites is directly accessible.<\/p>\n\n\n\n

Based on LMNTRIX Threat Intelligence, following regions have been observed to be the major targets when analysing the phishing campaigns associated with Emotet.<\/p>\n\n\n

\n
\"\"
Fig 1:<\/strong> Emotet Malware campaign targeting  countries across the globe<\/span><\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

Recently, this malware now provides Malware-as-a-Service (MaaS) to other malware groups to rent access to the Emotet-infected computers to infect them with other malware such as Trickbot Trojan and Ryuk Ransomware.<\/p>\n\n\n

\n
\"\"
Fig 2:<\/strong> Emotet in Action<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

The LMNTRIX Cyber Defence Center<\/a> has detected below samples across different client networks and has successfully helped them mitigate the threat using Active Defence protections. A few of these samples are explained below:<\/p>\n\n\n\n

Sample- 1<\/strong><\/h3>\n\n\n\n

Md5:  9d221f86f2f325f5e2625cd21de3d335<\/p>\n\n\n\n

Filename:  REP_RGMWSRXWSM4Z9TO.doc<\/p>\n\n\n\n

Location:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n


The malicious Word file contained VB Macro code, which is executed on file open, automatically. The macro code performed multiple suspicious actions upon execution \u2013<\/p>\n\n\n\n