Emotet Malware Makes a Comeback with New Evasion Techniques

Jan 24, 2023Ravie LakshmananCyber Threat / Cyber Crime

The Emotet malware operation has continued to refine its tactics
in an effort to fly under the radar, while also acting as a conduit
for other dangerous malware such as Bumblebee and IcedID.

Emotet, which officially reemerged^[1]
in late 2021 following a coordinated takedown of its infrastructure
by authorities earlier that year, has continued to be a persistent
threat that’s distributed via phishing emails.

Attributed to a cybercrime group tracked as TA542^[2]
(aka Gold Crestwood or Mummy Spider), the virus has evolved^[3]
from a banking trojan to a malware distributor since its first
appearance in 2014.

The malware-as-a-service (MaaS) is also modular, capable of
deploying an array of proprietary and freeware components that can
exfiltrate sensitive information from compromised machines and
carry out other post-exploitation activities.

Two latest additions to Emotet’s module arsenal comprise an
SMB spreader^[4]
that’s designed to facilitate lateral movement using a list of
hard-coded usernames and passwords, and a credit card stealer^[5]
that targets the Chrome web browser.

Recent campaigns involving the botnet have leveraged generic
lures with weaponized attachments to initiate the attack chain. But
with macros becoming an obsolete method^[6]
of payload distribution and initial infection, the attacks have
latched on to other methods^[7]
to sneak Emotet past malware detection tools.

“With the newest wave of Emotet spam emails, the attached .XLS
files have a new method for tricking users into allowing macros to
download the dropper,” BlackBerry disclosed^[8]
in a report published last week. “In addition to this, new Emotet
variants have now moved from 32bit to 64bit, as another method for
evading detection.”

The method involves instructing victims to move the decoy
Microsoft Excel files to the default Office Templates folder^[9]
in Windows, a location trusted by the operating system to execute
malicious macros embedded within the documents to deliver
Emotet.

The development points to Emotet’s steady attempts to retool
itself and propagate other malware, such as Bumblebee and IcedID^[10].

“With its steady evolution over the last eight-plus years,
Emotet has continued to become more sophisticated in terms of
evasion tactics; has added additional modules in an effort to
further propagate itself, and is now spreading malware via phishing
campaigns,” the company said.