@dfncert@infosec.exchange
26.09.2019
Aktuelle Informationen und Links rund um die Schadsoftware Emotet
!!! Aktuell vom 16.11.2021 - Emotet ist wieder aktiv !!!
- Guess who's back
- Emotet Returns
- Erneuter Versand von Emotet-Spam
- Emotet is back. Here's what we know.
- Quick Post - Emotet: The Mummy Returns (Again)
- Corporate Loader "Emotet": History of "X" Project Return for Ransomware
- Back from the dead: Emotet re-emerges, begins rebuilding to wrap up 2021
- Schadprogramm Emotet zurück in der Schweiz
- The Re-Emergence of Emotet
- Emotet now spreads via fake Adobe Windows App Installer packages
- Malware Analysis: Emotet’s 2021 Resurgence
- Emotet now drops Cobalt Strike, fast forwards ransomware attacks
- When old friends meet again: why Emotet chose Trickbot for rebirth
- Emotet’s Behavior & Spread Are Omens of Ransomware Attacks
- How the new Emotet differs from previous versions
- Emotet goes for the jugular; skips trojan payload in favor of direct Cobalt Strike installation
- Return of Emotet: Malware Analysis
- Emotet’s Return: What’s Different?
- Technical Malware Analysis: The return of Emotet (13.02.2022)
- New Emotet Infection Method (15.02.2022)
- New Wave of Emotet – When Project X Turns Into Y (24.02.2022)
- Emotet Redux (08.03.2022)
- 2022-03-14 EMOTET MALSPAM (15.03.2022)
- Emotet modules and recent attacks (13.04.2022)
- 2022-04-22 EMOTET MALSPAM USING EXCEL 4 MACRO (24.04.2022)
- Emotet Tests New Delivery Techniques (26.04.2022)
- Emotet: New Delivery Mechanism to Bypass VBA Protection (06.05.2022)
- Emotet Moves to 64 bit and Updates its Loader (16.05.2022)
- Emotet Summary: November 2021 Through January 2022 (17.05.2022)
- Bruised but Not Broken: The Resurgence of the Emotet Botnet Malware (19.05.2022)
- Emotet Botnet Rises Again (24.05.2022)
- Emotet Config Redux (25.05.2022)
- Emotet Analysis: New LNKs in the Infection Chain (27.05.2022)
- How Emotet is changing tactics in response to Microsoft’s tightening of Office macro security (16.06.2022, deutsche Version des Artikels)
- Emotet SMB spreader overview (20.06.2022)
- Emotet: Still Abusing Microsoft Office Macros (27.06.2022)
- Dead or Alive? An Emotet Story (12.09.2022)
- AdvIntel's State of Emotet aka "SpmTools" Displays Over Million Compromised Machines Through 2022 (13.09.2022)
- EMOTET Dynamic Configuration Extraction (28.10.2022)
- Emotet botnet starts blasting malware again after 4 month break (02.11.2022)
- The King Of Malware is Back (YouTube-Video vom 03.11.2022)
- Emotet coming in hot (08.11.2022)
- A Comprehensive Look at Emotet’s Fall 2022 Return (16.11.2022)
- Emotet Strikes Again – Lnk File Leads to Domain Wide Ransomware (28.11.2022)
- Bimonthly malware challege – Emotet (Back From the Dead) (19.12.2022)
- Emotet returns and deploys loaders (09.01.2023)
- Emotet Returns With New Methods of Evasion (20.01.2023)
- Emotet Unpacking (26.01.2023)
- Emotet Campaign (26.02.2023)
- Emotet malware attacks return after three-month break (07.03.2023)
- Emotet Sending Malicious Emails After Three-Month Hiatus (07.03.2023)
- Emotet Again! The First Malspam Wave of 2023 (10.03.2023)
- Emotet Returns, Now Adopts Binary Padding for Evasion (13.03.2023)
- Emotet resumes spam operations, switches to OneNote (22.03.2023)
- What’s up with Emotet? (06.07.2023, deutsche Fassung)
Informationen vom 27./28.01.2021
- Infrastruktur der Emotet-Schadsoftware zerschlagen
- WORLD’S MOST DANGEROUS MALWARE EMOTET DISRUPTED THROUGH GLOBAL ACTION
- Taking Down Emotet - How Team Cymru leveraged visibility and relationships to coordinate community efforts
- Europol: Emotet malware will uninstall itself on April 25th
Allgemeine Informationen zu Emotet
- Emotet: Eine Übersicht über die Schadsoftware
- Informationen zur Schadsoftware Emotet (Quelle: BSI für Bürger)
Technische Informationen (insb. IP-Adressen von C2-Servern)
Nachfolgend finden sich (fast) täglich aktualisierte technische Details rund um Emotet.
Dabei handelt es sich insbesondere um die aktuellen IP-Adressen der Command-and-Control (C2) Server. Diese IP-Adressen sollten, sofern möglich, blockiert/gefiltert werden:
- Crytpolaemus1 (via Twitter)
- Indicators of Compromise (IOCs) via abuse.ch
- Feodo Tracker Botnet C2 IP Blocklist / Hashes und C2 IPs
- Emotet via ThreatFox
- Emotet Samples (via MalwareBazaar)
- URLhaus
- Tools (diese Tools wurden nicht vom DFN-CERT getestet, wir führen sie hier der Vollständigkeit halber auf)
- EmoCheck (Quelle: unsere Kollegen von JPCERT/CC)
- emotet-malware-killer (Quelle: ion-storm)
- emotet-url-extractor (Quelle: infesc-consult)
- DeMotet (Quelle: Deep Instinct)
- Dynamische Emotet-Analysen (via ANY.RUN Sandbox)
- Yara-Regeln zur Erkennung möglicher Emotet-Infektionen (bspw. mittels ClamAV)
Weiterführende Informationen
- Statische Analyse von bösartigen Makros in Office-Dokumenten (am Beispiel der Schadsoftware Emotet)
- Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail (Quelle: Thomas Hungenberg, CERT-Bund)
- Defending Against Emotet (Quelle: Wilbur Security)
- Mitigating Emotet (Quelle: abuse.ch)
- Erfahrungen mit Emotet im Hochschulumfeld (Vortrag von TU Kaiserslautern/Uni Duisburg-Essen auf der 71. DFN-Betriebstagung)
- Emotet’s Central Position in the Malware Ecosystem (Quelle: Sophos)
- How to Respond to Emotet Infection (FAQ) (Quelle: unsere Kollegen von JPCERT/CC)
- Analysis of a New Emotet Maldoc with VBA Downloader (Quelle: security-soup.net)
- Quick Post: Analyzing Maldoc with “Do While” Loop in VBA Downloader (Quelle: security-soup.net)
- Maßnahmen zum Schutz vor Emotet und gefährlichen E-Mails im Allgemeinen (Quelle: Allianz für Cyber-Sicherheit / BSI)
- One Emotet infection leads to three follow-up malware infections (Quelle: Brad Duncan)
- Emotet: Not your Run-of-the-mill Malware (Quelle: Gigamon Applied Threat Research)
- Emotet-Artefakte, gefunden auf einer kompromittierten WordPress-Instanz (Quelle: https://twitter.com/Secu0133)
- Ransomware: Erste Hilfe bei einem schweren IT-Sicherheitsvorfall (Quelle: BSI)
- What’s up, Emotet? (Quelle: unsere Kollegen von CERT Polska)
- Meet the white-hat group fighting Emotet, the world's most dangerous malware (Quelle: Catalin Cimpanu)
- Microsoft und Emotet: Makroschutz in Office 365 nur für Konzerne (Quelle: heise Security)
- Emotet JavaScript downloader (Quelle: Max Kersten)
- Understanding the relationship between Emotet, Ryuk and TrickBot (Quelle: Intel 471)
- Awaiting the Inevitable Return of Emotet (Quelle: Hornetsecurity)
- Emotet botnet is now heavily spreading QakBot malware (Quelle: BleepingComputer)
- Emotet malware now steals your email attachments to attack contacts (Quelle: BleepingComputer)
- A Comprehensive Look at Emotet’s Summer 2020 Return (Quelle: Proofpoint)
- Case Study: Emotet Thread Hijacking, an Email Attack Technique (Quelle: Unit 42/Palo Alto Networks)
- Emotet Malware: CISA Alert (AA20-280A) (Quelle: Cybersecurity and Infrastructure Security Agency, CISA)
- Case study: the tale of one Emotet infection (Quelle: unsere Kollegen von CERT-EE)
- Emotet Illuminated: Mapping A Tiered Botnet Using Global Network Forensics (Quelle: Lumen Technologies)
- Behind the scenes of the Emotet Infrastructure (Quelle: NTT)
- Back from vacation: Analyzing Emotet’s activity in 2020 (Quelle: Cisco Talos)
- Evolution of Emotet: From Banking Trojan to Malware Distributor (Quelle: The Hacker News)
- Everything You Wish Your Parents Told You About Emotet (Quelle: The Swanepoel Method)
- The chronicles of Emotet (Quelle: Kaspersky Lab)
- From A to X analyzing some real cases which used recent Emotet samples (Quelle: VinCSS)
- Wireshark Tutorial: Examining Emotet Infection Traffic (Quelle: Brad Duncan, @malware_traffic)
- Restricting or blocking Office 2016/2019 macros with Group Policy (Quelle: 4sysops)
