I was searching this site for questions on Emotet and I was kind of baffled when nothing was on here. So the title is kind of self explanatory. See this question as an attempt to "complete" the content of this page.
How does the current (and/or former) iteration(s) of Emotet work?
This one is pretty advanced.
Infection method: malicious script, macro-enabled document files, or malicious link.
Cloaking: familiar branding designed to look like a legitimate e-mail.
Persuade mode: key words like “Your Invoice”, “Payment Details”, "Upcoming Shipment".
Versioning: Early versions arrived as a malicious JavaScript file (original one was used to steal bank account details by intercepting internet traffic). Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers.
Anti-countermeasures: detects if it’s running inside a virtual machine (VM) - will standby if it detects a sandbox environment. Emotet is a polymorphic Trojan that can evade typical signature-based detection. It has several methods for maintaining persistence, including auto-start registry keys and services. It uses modular Dynamic Link Libraries (DLLs) to continuously evolve and update its capabilities.
Update method: C&C servers, just like "Windows update" works. Updates allow additional malware installation (this is the current version) usually focused on banking Trojans, or convert itself into a system that assimilates stolen information such as financial credentials, usernames/passwords, and e-mail addresses, after which it sends them away.
Other capabilities: it can take advantage of the Windows Eternal Blue Vulnerability, starts various keep-alive services named as random numbers.
If you suspect an infection, isolate the system from the network immediately and run a deep scan with advanced anti-malware tools like Kaspersky or Malwarebytes. An alternate method is to restart in safe mode and perform a complete system restore and then scan your system with Reimage.
Other things that should be done is secure the e-mail part better and train users not to click/open everything they receive and report suspicious e-mails.
