I was searching this site for questions on Emotet and I was kind of baffled when nothing was on here. So the title is kind of self explanatory. See this question as an attempt to "complete" the content of this page.

How does the current (and/or former) iteration(s) of Emotet work?

  • 2
    We are not a malware removal site. I'd rather not have disinfection steps as part of malware answers.
    – schroeder
    Commented Sep 25, 2019 at 20:05

1 Answer 1


This one is pretty advanced.

Infection method: malicious script, macro-enabled document files, or malicious link.

Cloaking: familiar branding designed to look like a legitimate e-mail.

Persuade mode: key words like “Your Invoice”, “Payment Details”, "Upcoming Shipment".

Versioning: Early versions arrived as a malicious JavaScript file (original one was used to steal bank account details by intercepting internet traffic). Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers.

Anti-countermeasures: detects if it’s running inside a virtual machine (VM) - will standby if it detects a sandbox environment. Emotet is a polymorphic Trojan that can evade typical signature-based detection. It has several methods for maintaining persistence, including auto-start registry keys and services. It uses modular Dynamic Link Libraries (DLLs) to continuously evolve and update its capabilities.

Update method: C&C servers, just like "Windows update" works. Updates allow additional malware installation (this is the current version) usually focused on banking Trojans, or convert itself into a system that assimilates stolen information such as financial credentials, usernames/passwords, and e-mail addresses, after which it sends them away.

Other capabilities: it can take advantage of the Windows Eternal Blue Vulnerability, starts various keep-alive services named as random numbers.

If you suspect an infection, isolate the system from the network immediately and run a deep scan with advanced anti-malware tools like Kaspersky or Malwarebytes. An alternate method is to restart in safe mode and perform a complete system restore and then scan your system with Reimage.

Other things that should be done is secure the e-mail part better and train users not to click/open everything they receive and report suspicious e-mails.

  • 4
    If you suspect an infection, isolate the system from the network immediately and nuke it from orbit. Do not risk letting one component escape and infect your entire network. You don't cure malware, you kill the patient.
    – ThoriumBR
    Commented Sep 25, 2019 at 12:41
  • Of course the best way is to completely wipe-clean everything but most of the times people still need data from their system so they won't desire to do that.
    – Overmind
    Commented Sep 25, 2019 at 12:56
  • So disconnect, backup data on external drive, and nuke! Never ever try to "fix" a compromised computer, even more one compromised by an advanced malware with lots of components, cloaking methods, heavily obfuscated code... One computer is not worth the entire infrastructure... Nuke it.
    – ThoriumBR
    Commented Sep 25, 2019 at 12:58
  • @Overmind it uses also stolen sextortion email for reply-chain not only "your invoice"...and it feels like you're describing previous versions... Now Emotet uses WScript AND Powershell to drop payloads Commented Sep 25, 2019 at 14:12
  • Due to the update system it uses customized versions can appear at any time, but its main target was the banking system, not extortion-based stuff.
    – Overmind
    Commented Sep 26, 2019 at 5:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .