{"id":16322,"date":"2019-09-16T10:10:05","date_gmt":"2019-09-16T18:10:05","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/09\/16\/news-10063\/"},"modified":"2019-09-16T10:10:05","modified_gmt":"2019-09-16T18:10:05","slug":"news-10063","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/09\/16\/news-10063\/","title":{"rendered":"Emotet is back: botnet springs back to life with new spam campaign"},"content":{"rendered":"

Credit to Author: Threat Intelligence Team| Date: Mon, 16 Sep 2019 17:04:53 +0000<\/strong><\/p>\n

After a fairly long hiatus that lasted nearly four months, Emotet<\/a> is back with an active spam distribution campaign. For a few weeks, there were signs that the botnet was setting its gears in motion again, as we observed command and control (C2) server activity. But this morning, the Trojan started pumping out spam, a clear indication it’s ready to jump back into action.<\/p>\n

The malicious emails started in the wee hours of Monday morning, with templates spotted in German, Polish<\/a>, and Italian<\/a>. Our Threat Intelligence team has also captured phishing samples sent in English.<\/p>\n

\n
\"\"<\/figure>\n<\/div>\n

Victims are lured to open the attached document and enable the macro to kick-start the infection process.<\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n
\n
\"\"<\/a><\/figure>\n<\/div>\n

The PowerShell command triggered by the macro will attempt to download Emotet from compromised sites, often running the WordPress CMS.<\/p>\n

Once installed on the endpoint, Emotet attempts to spread laterally, in addition to stealing passwords from installed applications. Perhaps the biggest threat, though, is that Emotet serves as a delivery vector for more dangerous payloads, such as ransomware<\/a>.<\/p>\n

Compromised machines can lay in a dormant state until operators decide to hand off the job to other criminal groups that will attempt to extort large sums of money from their victims. In the past, we’ve seen the infamous Ryuk<\/a> ransomware being deployed that way<\/a>.<\/p>\n

While Emotet is typically focused on infecting organizations, Malwarebytes business and individual customers are already protected <\/a>against this campaign, thanks to our signature-less anti-exploit technology. As always, we recommend users be cautious when opening emails with attachments<\/a>, even if they appear to come from acquaintances. <\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n

As this campaign is not even a day old, we don’t yet know the impact on organizations and other users. We will continue to update this post as we learn more throughout the day. In the meantime, warn your coworkers, friends, and family to be wary of emails disguised as invoices or any other “phishy”<\/a> instances.<\/p>\n

Indicators of Compromise<\/h3>\n

Malicious Word document<\/strong><\/p>\n

eee144531839763b15051badbbda9daae38f60c02abaa7794a046f96a68cd10b<\/p>\n

Hacked WordPress websites hosting the Emotet binary<\/strong><\/p>\n

danangluxury[.]com\/wp-content\/uploads\/KTgQsblu\/
gcesab[.]com\/wp-includes\/customize\/zUfJervuM\/
autorepuestosdml[.]com\/wp-content\/CiloXIptI\/<\/p>\n

Emotet binary<\/strong><\/p>\n

8f05aa95aa7b2146ee490c2305a2450e58ce1d1e3103e6f9019767e5568f233e<\/p>\n

Post-infection traffic<\/strong><\/p>\n

179.12.170[.]88:8080\/results\/tlb\/<\/p>\n

The post Emotet is back: botnet springs back to life with new spam campaign<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Threat Intelligence Team| Date: Mon, 16 Sep 2019 17:04:53 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
After months of laying dormant, the notorious Emotet is back, with its botnet spewing spam globally.<\/p>\n

Categories: <\/p>\n