{"id":18784,"date":"2022-04-17T20:40:02","date_gmt":"2022-04-18T04:40:02","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/04\/17\/news-12517\/"},"modified":"2022-04-17T20:40:02","modified_gmt":"2022-04-18T04:40:02","slug":"news-12517","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/04\/17\/news-12517\/","title":{"rendered":"Trends in the Recent Emotet Maldoc Outbreak"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

Affected Platforms:<\/b> Microsoft Windows
Impacted Users:<\/b> Windows users
Impact: <\/b>Controls victim’s device and collects sensitive information
Severity Level<\/b>: Critical <\/p>\n

Emotet is a malware<\/a> family that steals sensitive and private information from victims’ computers. The malware has infected more than a million devices and is considered one of the most dangerous threats of the decade.<\/p>\n

In addition to analyzing threats, FortiGuard Labs<\/a> also focuses on how malware spreads. We have observed that the recent Emotet outbreak is being spread through a variety of malicious Microsoft Office files, or maldocs, attached to phishing emails<\/a>. Once a victim opens the attached document, a VBA Macro or Excel 4.0 Macro is used to execute malicious code that downloads and runs the Emotet malware.<\/p>\n

In this blog, we will focus on what these malicious documents look like and how they drop Emotet malware onto a victim’s local disk. We will first look at the samples captured in this campaign and then examine their propagation trends.<\/p>\n

Phishing Emails with Malicious Attachment<\/h2>\n

The recent Emotet outbreak uses phishing emails combined with social engineering to trick victims into loading the malware onto their devices. These emails often include "Re:" or "Fw:" in the subject line, as shown in Figure 1 and 2, to disguise the email as a reply or forwarded message to help convince the target that the email is legitimate.<\/p>\n<\/p><\/div>\n