{"id":18865,"date":"2022-04-27T03:10:06","date_gmt":"2022-04-27T11:10:06","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/04\/27\/news-12598\/"},"modified":"2022-04-27T03:10:06","modified_gmt":"2022-04-27T11:10:06","slug":"news-12598","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/04\/27\/news-12598\/","title":{"rendered":"Emotet fixes bug in code, resumes spam campaign"},"content":{"rendered":"

Credit to Author: Jovi Umawing| Date: Wed, 27 Apr 2022 10:15:34 +0000<\/strong><\/p>\n

Emotet threat actors resumed their email spam campaign on Monday after stopping it late last week to fix a bug.<\/p>\n

The bug\u2014a flaw in how Emotet is installed onto a system after a victim opens a malicious email attachment\u2014forced the actors to prematurely halt their campaign.<\/p>\n

\n
\"\"
Sample email of an Emotet spam containing a defective attachment.
(Source: @malware_traffic<\/a>)<\/em><\/figcaption><\/figure>\n<\/div>\n

Emotet is spammed around in emails claiming to contain invoices, forms, or payment details. The attachment is a password-protected ZIP file with a shortcut link file (has the .LNK extension) inside pretending to be a Word document file.<\/p>\n

Normally, once users double-click the file, Emotet is loaded into memory, steals email addresses to use in future campaigns, and drops a payload, usually another malware like ransomware or Cobalt Strike<\/a>. However, the bug happened immediately after the attachment was clicked.<\/p>\n

You see, double-clicking the file sets off a chain. A command looks for a string hidden in the .LNK file containing code written in Visual Basic. This code is then appended to a new VBS file before executing that file. But, the shortcut file a command statically calls to does not match the actual name of the attached shortcut file. For example, the command code calls for “Password2.doc.lnk”, but the attached file itself is named “INVOICE 2022-04-22_1033, USA.doc”. This error breaks the infection chain.<\/p>\n

Cryptolaemus (@Cryptolaemus1<\/a>) has provided a more technical explanation in this Twitter thread:<\/p>\n

\n
\n
\n

#emotet<\/a> Update – As of the last few hours Ivan is running some tests on E4 to try to bypass detection by appending a VBS at the end of an LNK file in a zip. The LNK when launched will find a string in itself and then copy the remainder from that string after to a VBS file. 1\/x https:\/\/t.co\/pEcOWdbfOa<\/a><\/p>\n

— Cryptolaemus (@Cryptolaemus1) April 22, 2022<\/a><\/p><\/blockquote>\n