I was searching this site for questions on Emotet and I was kind of baffled when nothing was on here. So the title is kind of self explanatory. See this question as an attempt to "complete" the content of this page.

How does the current (and/or former) iteration(s) of Emotet work?

  • 2
    We are not a malware removal site. I'd rather not have disinfection steps as part of malware answers. – schroeder Sep 25 '19 at 20:05

This one is pretty advanced.

Infection method: malicious script, macro-enabled document files, or malicious link.

Cloaking: familiar branding designed to look like a legitimate e-mail.

Persuade mode: key words like “Your Invoice”, “Payment Details”, "Upcoming Shipment".

Versioning: Early versions arrived as a malicious JavaScript file (original one was used to steal bank account details by intercepting internet traffic). Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers.

Anti-countermeasures: detects if it’s running inside a virtual machine (VM) - will standby if it detects a sandbox environment. Emotet is a polymorphic Trojan that can evade typical signature-based detection. It has several methods for maintaining persistence, including auto-start registry keys and services. It uses modular Dynamic Link Libraries (DLLs) to continuously evolve and update its capabilities.

Update method: C&C servers, just like "Windows update" works. Updates allow additional malware installation (this is the current version) usually focused on banking Trojans, or convert itself into a system that assimilates stolen information such as financial credentials, usernames/passwords, and e-mail addresses, after which it sends them away.

Other capabilities: it can take advantage of the Windows Eternal Blue Vulnerability, starts various keep-alive services named as random numbers.

If you suspect an infection, isolate the system from the network immediately and run a deep scan with advanced anti-malware tools like Kaspersky or Malwarebytes. An alternate method is to restart in safe mode and perform a complete system restore and then scan your system with Reimage.

Other things that should be done is secure the e-mail part better and train users not to click/open everything they receive and report suspicious e-mails.

  • 4
    If you suspect an infection, isolate the system from the network immediately and nuke it from orbit. Do not risk letting one component escape and infect your entire network. You don't cure malware, you kill the patient. – ThoriumBR Sep 25 '19 at 12:41
  • Of course the best way is to completely wipe-clean everything but most of the times people still need data from their system so they won't desire to do that. – Overmind Sep 25 '19 at 12:56
  • So disconnect, backup data on external drive, and nuke! Never ever try to "fix" a compromised computer, even more one compromised by an advanced malware with lots of components, cloaking methods, heavily obfuscated code... One computer is not worth the entire infrastructure... Nuke it. – ThoriumBR Sep 25 '19 at 12:58
  • @Overmind it uses also stolen sextortion email for reply-chain not only "your invoice"...and it feels like you're describing previous versions... Now Emotet uses WScript AND Powershell to drop payloads – Soufiane Tahiri Sep 25 '19 at 14:12
  • Due to the update system it uses customized versions can appear at any time, but its main target was the banking system, not extortion-based stuff. – Overmind Sep 26 '19 at 5:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.