SYMBOLCOMMON_NAMEaka. SYNONYMS
win.emotet (Back to overview)

Emotet

aka: Geodo, Heodo

Actor(s): GOLD CABIN, MUMMY SPIDER, Mealybug

VTCollection     URLhaus                                  

While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.
It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.
Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.

References
2024-02-11 ⋅ Estrellas's Blog ⋅ Otávio M.
Unpacking an Emotet trojan
Emotet
2024-01-12 ⋅ YouTube (BSides Cambridge UK) ⋅ Cian Heasley
Slipping The Net: Qakbot, Emotet And Defense Evasion
Emotet QakBot
2024-01-09 ⋅ Recorded Future ⋅ Insikt Group
2023 Adversary Infrastructure Report
AsyncRAT Cobalt Strike Emotet PlugX ShadowPad
2023-12-10 ⋅ cocomelonc ⋅ cocomelonc
Malware development: persistence - part 23. LNK files. Simple Powershell example.
Emotet
2023-08-03 ⋅ Kaspersky ⋅ Kaspersky
What’s happening in the world of crimeware: Emotet, DarkGate and LokiBot
LokiBot DarkGate Emotet
2023-07-23 ⋅ Medium infoSec Write-ups ⋅ mov_eax_27
Unpacking an Emotet Trojan
Emotet
2023-07-06 ⋅ WeLiveSecurity ⋅ Jakub Kaloč
What’s up with Emotet?
Emotet
2023-05-18 ⋅ Intezer ⋅ Ryan Robinson
How Hackers Use Binary Padding to Outsmart Sandboxes and Infiltrate Your Systems
Emotet
2023-04-12 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q1 2023
FluBot Amadey AsyncRAT Aurora Ave Maria BumbleBee Cobalt Strike DCRat Emotet IcedID ISFB NjRAT QakBot RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee Vidar
2023-04-10 ⋅ Check Point ⋅ Check Point
March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files
Agent Tesla CloudEyE Emotet Formbook Nanocore RAT NjRAT QakBot Remcos Tofsee
2023-03-30 ⋅ loginsoft ⋅ Saharsh Agrawal
From Innocence to Malice: The OneNote Malware Campaign Uncovered
Agent Tesla AsyncRAT DOUBLEBACK Emotet Formbook IcedID NetWire RC QakBot Quasar RAT RedLine Stealer XWorm
2023-03-30 ⋅ United States District Court (Eastern District of New York) ⋅ Fortra, HEALTH-ISAC, Microsoft
Cracked Cobalt Strike (1:23-cv-02447)
Black Basta BlackCat LockBit RagnarLocker LockBit Black Basta BlackCat Cobalt Strike Cuba Emotet LockBit Mount Locker PLAY QakBot RagnarLocker Royal Ransom Zloader
2023-03-22 ⋅ Cisco Talos ⋅ Edmund Brumaghin, Jaeson Schultz
Emotet Resumes Spam Operations, Switches to OneNote
Emotet
2023-03-13 ⋅ Trendmicro ⋅ Ian Kenefick
Emotet Returns, Now Adopts Binary Padding for Evasion
Emotet
2023-03-07 ⋅ Cofense ⋅ Cofense
Emotet Sending Malicious Emails After Three-Month Hiatus
Emotet
2023-03-07 ⋅ BleepingComputer ⋅ Lawrence Abrams
Emotet malware attacks return after three-month break
Emotet
2023-02-26 ⋅ Medium Ilandu ⋅ Ilan Duhin, Yossi Poberezsky
Emotet Campaign
Emotet
2023-01-30 ⋅ Checkpoint ⋅ Arie Olshtein
Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware
Agent Tesla Azorult Buer Cerber Cobalt Strike Emotet Formbook HawkEye Keylogger Loki Password Stealer (PWS) Maze NetWire RC Remcos REvil TrickBot
2023-01-26 ⋅ Acronis ⋅ Ilan Duhin
Unpacking Emotet Malware
Emotet
2023-01-20 ⋅ Blackberry ⋅ BlackBerry Research & Intelligence Team
Emotet Returns With New Methods of Evasion
Emotet IcedID
2023-01-09 ⋅ Intrinsec ⋅ CTI Intrinsec, Intrinsec
Emotet returns and deploys loaders
BumbleBee Emotet IcedID PHOTOLITE
2022-12-19 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
[Z2A]Bimonthly malware challege – Emotet (Back From the Dead)
Emotet
2022-12-06 ⋅ EuRepoC ⋅ Camille Borrett, Kerstin Zettl-Schabath, Lena Rottinger
Conti/Wizard Spider
BazarBackdoor Cobalt Strike Conti Emotet IcedID Ryuk TrickBot WIZARD SPIDER
2022-11-28 ⋅ The DFIR Report ⋅ The DFIR Report
Emotet Strikes Again – LNK File Leads to Domain Wide Ransomware
Emotet Mount Locker
2022-11-21 ⋅ BSides Sydney ⋅ Thomas Roccia
X-Ray of Malware Evasion Techniques - Analysis, Dissection, Cure?
Emotet
2022-11-16 ⋅ Proofpoint ⋅ Axel F, Pim Trouerbach
A Comprehensive Look at Emotet Virus’ Fall 2022 Return
BumbleBee Emotet PHOTOLITE
2022-11-10 ⋅ Intezer ⋅ Nicole Fishbein
How LNK Files Are Abused by Threat Actors
BumbleBee Emotet Mount Locker QakBot
2022-10-28 ⋅ Elastic ⋅ @rsprooten, Elastic Security Intelligence & Analytics Team
EMOTET dynamic config extraction
Emotet
2022-10-13 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q3 2022
FluBot Arkei Stealer AsyncRAT Ave Maria BumbleBee Cobalt Strike DCRat Dridex Emotet Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT QakBot RecordBreaker RedLine Stealer Remcos Socelars Tofsee Vjw0rm
2022-10-03 ⋅ vmware ⋅ Threat Analysis Unit
Emotet Exposed: A Look Inside the Cybercriminal Supply Chain
Emotet
2022-09-13 ⋅ AdvIntel ⋅ Advanced Intelligence
AdvIntel's State of Emotet aka "SpmTools" Displays Over Million Compromised Machines Through 2022
Conti Cobalt Strike Emotet Ryuk TrickBot
2022-09-12 ⋅ The DFIR Report ⋅ The DFIR Report
Dead or Alive? An Emotet Story
Cobalt Strike Emotet
2022-08-23 ⋅ Darktrace ⋅ Eugene Chua, Hanah Darley, Paul Jennings
Emotet Resurgence: Cross-Industry Campaign Analysis
Emotet
2022-08-19 ⋅ vmware ⋅ Oleg Boyarchuk, Stefano Ortolani
How to Replicate Emotet Lateral Movement
Emotet
2022-08-10 ⋅ BitSight ⋅ João Batista
Emotet SMB Spreader is Back
Emotet
2022-07-17 ⋅ Resecurity ⋅ Resecurity
Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise
AsyncRAT BumbleBee Emotet IcedID QakBot
2022-07-12 ⋅ Cyren ⋅ Kervin Alintanahin
Example Analysis of Multi-Component Malware
Emotet Formbook
2022-07-07 ⋅ SANS ISC ⋅ Brad Duncan
Emotet infection with Cobalt Strike
Cobalt Strike Emotet
2022-07-07 ⋅ Fortinet ⋅ Erin Lin
Notable Droppers Emerge in Recent Threat Campaigns
BumbleBee Emotet PhotoLoader QakBot
2022-06-27 ⋅ Netskope ⋅ Gustavo Palazolo
Emotet: Still Abusing Microsoft Office Macros
Emotet
2022-06-21 ⋅ McAfee ⋅ Lakshya Mathur
Rise of LNK (Shortcut files) Malware
BazarBackdoor Emotet IcedID QakBot
2022-06-16 ⋅ ESET Research ⋅ Rene Holt
How Emotet is changing tactics in response to Microsoft’s tightening of Office macro security
Emotet
2022-06-02 ⋅ Mandiant ⋅ Mandiant
TRENDING EVIL Q2 2022
CloudEyE Cobalt Strike CryptBot Emotet IsaacWiper QakBot
2022-05-27 ⋅ Kroll ⋅ Cole Manaster, Elio Biasiotto, George Glass
Emotet Analysis: New LNKs in the Infection Chain – The Monitor, Issue 20
Emotet
2022-05-25 ⋅ vmware ⋅ Oleg Boyarchuk, Stefano Ortolani
Emotet Config Redux
Emotet
2022-05-24 ⋅ BitSight ⋅ BitSight, João Batista, Pedro Umbelino
Emotet Botnet Rises Again
Cobalt Strike Emotet QakBot SystemBC
2022-05-24 ⋅ Deep instinct ⋅ Bar Block
Blame the Messenger: 4 Types of Dropper Malware in Microsoft Office & How to Detect Them
Dridex Emotet
2022-05-19 ⋅ Trend Micro ⋅ Adolph Christian Silverio, Jeric Miguel Abordo, Khristian Joseph Morales, Maria Emreen Viray
Bruised but Not Broken: The Resurgence of the Emotet Botnet Malware
Emotet QakBot
2022-05-17 ⋅ Palo Alto Networks Unit 42 ⋅ Brad Duncan
Emotet Summary: November 2021 Through January 2022
Emotet
2022-05-16 ⋅ vmware ⋅ Jason Zhang, Oleg Boyarchuk, Stefano Ortolani, Threat Analysis Unit
Emotet Moves to 64 bit and Updates its Loader
Emotet
2022-05-11 ⋅ HP ⋅ HP Wolf Security
Threat Insights Report Q1 - 2022
AsyncRAT Emotet Mekotio Vjw0rm
2022-05-11 ⋅ IronNet ⋅ Blake Cahen, IronNet Threat Research
Detecting a MUMMY SPIDER campaign and Emotet infection
Emotet
2022-05-09 ⋅ Netresec ⋅ Erik Hjelmvik
Emotet C2 and Spam Traffic Video
Emotet
2022-05-09 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT
2022-05-06 ⋅ Netskope ⋅ Gustavo Palazolo
Emotet: New Delivery Mechanism to Bypass VBA Protection
Emotet
2022-05-04 ⋅ Sophos ⋅ Andreas Klopsch
Attacking Emotet’s Control Flow Flattening
Emotet
2022-04-28 ⋅ Symantec ⋅ Karthikeyan C Kasiviswanathan, Vishal Kamble
Ransomware: How Attackers are Breaching Corporate Networks
AvosLocker Conti Emotet Hive IcedID PhotoLoader QakBot TrickBot
2022-04-27 ⋅ Cybleinc ⋅ Cyble
Emotet Returns With New TTPs And Delivers .Lnk Files To Its Victims
Emotet
2022-04-26 ⋅ Proofpoint ⋅ Axel F
Emotet Tests New Delivery Techniques
Emotet
2022-04-26 ⋅ Bleeping Computer ⋅ Ionut Ilascu
Emotet malware now installs via PowerShell in Windows shortcut files
Emotet
2022-04-26 ⋅ Intel 471 ⋅ Intel 471
Conti and Emotet: A constantly destructive duo
Cobalt Strike Conti Emotet IcedID QakBot TrickBot
2022-04-24 ⋅ forensicitguy ⋅ Tony Lambert
Shortcut to Emotet, an odd TTP change
Emotet
2022-04-20 ⋅ CISA ⋅ Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), CISA, FBI, Government Communications Security Bureau, National Crime Agency (NCA), NCSC UK, NSA
AA22-110A Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader
2022-04-20 ⋅ CISA ⋅ CISA
Alert (AA22-110A): Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader Killnet
2022-04-20 ⋅ cocomelonc ⋅ cocomelonc
Malware development: persistence - part 1. Registry run keys. C++ example.
Agent Tesla Amadey BlackEnergy Cobian RAT COZYDUKE Emotet Empire Downloader Kimsuky
2022-04-19 ⋅ Twitter (@Cryptolaemus1) ⋅ Cryptolaemus
#Emotet Update: 64 bit upgrade of Epoch 5
Emotet
2022-04-19 ⋅ Bleeping Computer ⋅ Bill Toulas
Emotet botnet switches to 64-bit modules, increases activity
Emotet
2022-04-18 ⋅ Fortinet ⋅ Erin Lin
Trends in the Recent Emotet Maldoc Outbreak
Emotet
2022-04-17 ⋅ BushidoToken Blog ⋅ BushidoToken
Lessons from the Conti Leaks
BazarBackdoor Conti Emotet IcedID Ryuk TrickBot
2022-04-13 ⋅ Kaspersky ⋅ AMR
Emotet modules and recent attacks
Emotet
2022-04-12 ⋅ AhnLab ⋅ ASEC Analysis Team
SystemBC Being Used by Various Attackers
Emotet SmokeLoader SystemBC
2022-04-12 ⋅ Check Point ⋅ Check Point Research
March 2022’s Most Wanted Malware: Easter Phishing Scams Help Emotet Assert its Dominance
Alien FluBot Agent Tesla Emotet
2022-04-08 ⋅ ReversingLabs ⋅ Paul Roberts
ConversingLabs Ep. 2: Conti pivots as ransomware as a service struggles
Conti Emotet TrickBot
2022-04-02 ⋅ Github (pl-v) ⋅ Player-V
Emotet Analysis Part 1: Unpacking
Emotet
2022-03-30 ⋅ Prevailion ⋅ Prevailion
Wizard Spider continues to confound
BazarBackdoor Cobalt Strike Emotet
2022-03-29 ⋅ vmware ⋅ Jason Zhang, Oleg Boyarchuk, Threat Analysis Unit
Emotet C2 Configuration Extraction and Analysis
Emotet
2022-03-28 ⋅ Cisco ⋅ Adela Jezkova, María José Erquiaga, Onur Erdogan
Emotet is Back
Emotet
2022-03-23 ⋅ NVISO Labs ⋅ Bart Parys
Hunting Emotet campaigns with Kusto
Emotet
2022-03-23 ⋅ Fortinet ⋅ Xiaopeng Zhang
MS Office Files Involved Again in Recent Emotet Trojan Campaign – Part II
Emotet
2022-03-23 ⋅ Fortinet ⋅ Shunichi Imano, Val Saengphaibul
Bad Actors Trying to Capitalize on Current Events via Shameless Email Scams
Emotet
2022-03-23 ⋅ Secureworks ⋅ Counter Threat Unit ResearchTeam
Threat Intelligence Executive Report Volume 2022, Number 2
Conti Emotet IcedID TrickBot
2022-03-23 ⋅ Secureworks ⋅ Counter Threat Unit ResearchTeam
GOLD ULRICK Leaks Reveal Organizational Structure and Relationships
Conti Emotet IcedID TrickBot
2022-03-21 ⋅ Info Security ⋅ Vinugayathri Chinnasamy
Emotet Is Back and Is Deadlier Than Ever! A Rundown of the Emotet Malware
Emotet
2022-03-16 ⋅ Dragos ⋅ Josh Hanrahan
Suspected Conti Ransomware Activity in the Auto Manufacturing Sector
Conti Emotet
2022-03-16 ⋅ Symantec ⋅ Symantec Threat Hunter Team
The Ransomware Threat Landscape: What to Expect in 2022
AvosLocker BlackCat BlackMatter Conti DarkSide DoppelPaymer Emotet Hive Karma Mespinoza Nemty Squirrelwaffle VegaLocker WastedLocker Yanluowang Zeppelin
2022-03-08 ⋅ Lumen ⋅ Black Lotus Labs
What Global Network Visibility Reveals about the Resurgence of One of the World’s Most Notorious Botnets
Emotet
2022-03-07 ⋅ Fortinet ⋅ Xiaopeng Zhang
MS Office Files Involved Again in Recent Emotet Trojan Campaign – Part I
Emotet
2022-03-03 ⋅ Trend Micro ⋅ Trend Micro Research
Cyberattacks are Prominent in the Russia-Ukraine Conflict
BazarBackdoor Cobalt Strike Conti Emotet WhisperGate
2022-03-02 ⋅ KrebsOnSecurity ⋅ Brian Krebs
Conti Ransomware Group Diaries, Part II: The Office
Conti Emotet Ryuk TrickBot
2022-03-01 ⋅ Twitter (@ContiLeaks) ⋅ ContiLeaks
Tweet on Emotet final server scheme
Emotet
2022-02-25 ⋅ CyberScoop ⋅ Joe Warminsky
TrickBot malware suddenly got quiet, researchers say, but it's hardly the end for its operators
BazarBackdoor Emotet TrickBot
2022-02-24 ⋅ The Hacker News ⋅ Ravie Lakshmanan
TrickBot Gang Likely Shifting Operations to Switch to New Malware
BazarBackdoor Emotet QakBot TrickBot
2022-02-24 ⋅ The Hacker News ⋅ Ravie Lakshmanan
Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure
BazarBackdoor Emotet TrickBot
2022-02-24 ⋅ Cynet ⋅ Max Malyutin
New Wave of Emotet – When Project X Turns Into Y
Cobalt Strike Emotet
2022-02-23 ⋅ cyber.wtf blog ⋅ Luca Ebach
What the Pack(er)?
Cobalt Strike Emotet
2022-02-16 ⋅ Security Onion ⋅ Doug Burks
Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08
Cobalt Strike Emotet
2022-02-16 ⋅ Threat Post ⋅ Elizabeth Montalbano
Emotet Now Spreading Through Malicious Excel Files
Emotet
2022-02-15 ⋅ Palo Alto Networks Unit 42 ⋅ Brad Duncan, Micah Yates, Saqib Khanzada, Tyler Halfpop
New Emotet Infection Method
Emotet
2022-02-15 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
Increase in Emotet Activity and Cobalt Strike Deployment
Cobalt Strike Emotet
2022-02-13 ⋅ NetbyteSEC ⋅ Fareed, Rosamira, Taqi
Technical Malware Analysis: The Return of Emotet
Emotet
2022-02-10 ⋅ Cybereason ⋅ Cybereason Global SOC Team
Threat Analysis Report: All Paths Lead to Cobalt Strike - IcedID, Emotet and QBot
Cobalt Strike Emotet IcedID QakBot
2022-02-07 ⋅ vmware ⋅ Jason Zhang, Threat Analysis Unit
Emotet Is Not Dead (Yet) – Part 2
Emotet
2022-02-02 ⋅ VMRay ⋅ Mateusz Lukaszewski, VMRay Labs Team
Malware Analysis Spotlight: Emotet’s Use of Cryptography
Emotet
2022-01-27 ⋅ ⋅ Threat Lab Indonesia ⋅ Threat Lab Indonesia
Malware Analysis Emotet Infection
Emotet
2022-01-25 ⋅ SANS ISC ⋅ Brad Duncan
Emotet Stops Using 0.0.0.0 in Spambot Traffic
Emotet
2022-01-23 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
[QuickNote] Emotet epoch4 & epoch5 tactics
Emotet
2022-01-22 ⋅ Atomic Matryoshka ⋅ z3r0day_504
Malware Headliners: Emotet
Emotet
2022-01-21 ⋅ Trend Micro ⋅ Ian Kenefick
Emotet Spam Abuses Unconventional IP Address Formats to Spread Malware
Emotet
2022-01-21 ⋅ vmware ⋅ Jason Zhang, Threat Analysis Unit
Emotet Is Not Dead (Yet)
Emotet
2022-01-19 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
0.0.0.0 in Emotet Spambot Traffic
Emotet
2022-01-19 ⋅ Gdata ⋅ Karsten Hahn
Malware vaccines can prevent pandemics, yet are rarely used
Emotet STOP
2022-01-17 ⋅ forensicitguy ⋅ Tony Lambert
Emotet's Excel 4.0 Macros Dropping DLLs
Emotet
2022-01-14 ⋅ RiskIQ ⋅ Jordan Herman
RiskIQ: Unique SSL Certificates and JARM Hash Connected to Emotet and Dridex C2 Servers
Dridex Emotet
2022-01-07 ⋅ muha2xmad ⋅ Muhammad Hasan Ali
Unpacking Emotet malware part 02
Emotet
2022-01-06 ⋅ muha2xmad ⋅ Muhammad Hasan Ali
Unpacking Emotet malware part 01
Emotet
2021-12-22 ⋅ Cloudsek ⋅ Anandeshwar Unnikrishnan
Emotet 2.0: Everything you need to know about the new Variant of the Banking Trojan
Emotet
2021-12-13 ⋅ Zscaler ⋅ Avinash Kumar, Dennis Schwarz
Return of Emotet: Malware Analysis
Emotet
2021-12-09 ⋅ HP ⋅ Patrick Schläpfer
Emotet’s Return: What’s Different?
Emotet
2021-12-08 ⋅ Check Point Research ⋅ Aliaksandr Trafimchuk, David Driker, Raman Ladutska, Yali Magiel
When old friends meet again: why Emotet chose Trickbot for rebirth
Emotet TrickBot
2021-12-07 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Emotet now drops Cobalt Strike, fast forwards ransomware attacks
Cobalt Strike Emotet
2021-11-30 ⋅ Deep instinct ⋅ Ron Ben Yizhak
The Re-Emergence of Emotet
Emotet
2021-11-25 ⋅ ⋅ DSIH ⋅ Charles Blanc-Rolin
Emotet de retour, POC Exchange, 0-day Windows : à quelle sauce les attaquants prévoient de nous manger cette semaine?
Emotet
2021-11-23 ⋅ Anomali ⋅ Anomali Threat Research
Mummy Spider’s Emotet Malware is Back After a Year Hiatus; Wizard Spider’s TrickBot Observed in Its Return
Emotet
2021-11-20 ⋅ Advanced Intelligence ⋅ Vitali Kremez, Yelisey Boguslavskiy
Corporate Loader "Emotet": History of "X" Project Return for Ransomware
Emotet
2021-11-20 ⋅ Twitter (@eduardfir) ⋅ Eduardo Mattos
Tweet on Velociraptor artifact analysis for Emotet
Emotet
2021-11-20 ⋅ Youtube (HEXORCIST) ⋅ Nicolas Brulez
Unpacking Emotet and Reversing Obfuscated Word Document
Emotet
2021-11-19 ⋅ LAC WATCH ⋅ LAC WATCH
Malware Emotet resumes its activities for the first time in 10 months, and Japan is also the target of the attack
Emotet
2021-11-19 ⋅ ⋅ CRONUP ⋅ Germán Fernández
La Botnet de EMOTET reinicia ataques en Chile y LATAM
Emotet
2021-11-18 ⋅ eSentire ⋅ eSentire
Emotet Activity Identified
Emotet
2021-11-18 ⋅ Netskope ⋅ Ghanashyam Satpathy, Gustavo Palazolo
Netskope Threat Coverage: The Return of Emotet
Emotet
2021-11-16 ⋅ Malwarebytes ⋅ Malwarebytes Threat Intelligence Team
TrickBot helps Emotet come back from the dead
Emotet TrickBot
2021-11-16 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Emotet Returns
Emotet
2021-11-16 ⋅ Zscaler ⋅ Deepen Desai
Return of Emotet malware
Emotet
2021-11-16 ⋅ Hornetsecurity ⋅ Security Lab
Comeback of Emotet
Emotet
2021-11-15 ⋅ cyber.wtf blog ⋅ Luca Ebach
Guess who’s back
Emotet
2021-11-15 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Emotet malware is back and rebuilding its botnet via TrickBot
Emotet
2021-08-15 ⋅ Symantec ⋅ Threat Hunter Team
The Ransomware Threat
Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker
2021-07-12 ⋅ The Record ⋅ Catalin Cimpanu
Over 780,000 email accounts compromised by Emotet have been secured
Emotet
2021-06-16 ⋅ ⋅ S2 Grupo ⋅ CSIRT-CV (the ICT Security Center of the Valencian Community)
Emotet campaign analysis
Emotet QakBot
2021-06-10 ⋅ ZEIT Online ⋅ Astrid Geisler, Herwig G. Höller, Karsten Polke-Majewski, Von Kai Biermann, Zachary Kamel
On the Trail of the Internet Extortionists
Emotet Mailto
2021-06-10 ⋅ Tagesschau ⋅ Hakan Tanriverdi, Maximilian Zierer
Schadsoftware Emotet: BKA befragt Schlüsselfigur
Emotet
2021-05-26 ⋅ DeepInstinct ⋅ Ron Ben Yizhak
A Deep Dive into Packing Software CryptOne
Cobalt Strike Dridex Emotet Gozi ISFB Mailto QakBot SmokeLoader WastedLocker Zloader
2021-05-10 ⋅ ⋅ Wirtschaftswoche ⋅ Thomas Kuhn
How one of the largest hacker networks in the world was paralyzed
Emotet
2021-04-22 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q1 2021
Emotet Ficker Stealer Raccoon
2021-04-22 ⋅ Github (@cecio) ⋅ @red5heep
EMOTET: a State-Machine reversing exercise
Emotet
2021-04-09 ⋅ Palo Alto Networks Unit 42 ⋅ Chris Navarrete, Yanhui Jia
Emotet Command and Control Case Study
Emotet
2021-03-31 ⋅ Kaspersky ⋅ Kaspersky
Financial Cyberthreats in 2020
BetaBot DanaBot Emotet Gozi Ramnit RTM SpyEye TrickBot Zeus
2021-03-31 ⋅ Red Canary ⋅ Red Canary
2021 Threat Detection Report
Shlayer Andromeda Cobalt Strike Dridex Emotet IcedID MimiKatz QakBot TrickBot
2021-03-21 ⋅ Blackberry ⋅ Blackberry Research
2021 Threat Report
Bashlite FritzFrog IPStorm Mirai Tsunami elf.wellmess AppleJeus Dacls EvilQuest Manuscrypt Astaroth BazarBackdoor Cerber Cobalt Strike Emotet FinFisher RAT Kwampirs MimiKatz NjRAT Ryuk SmokeLoader TrickBot
2021-03-17 ⋅ HP ⋅ HP Bromium
Threat Insights Report Q4-2020
Agent Tesla BitRAT ComodoSec Dridex Emotet Ficker Stealer Formbook Zloader
2021-03-08 ⋅ Palo Alto Networks Unit 42 ⋅ Chris Navarrete, Durgesh Sangvikar, Matthew Tennis, Rongbo Shao, Yanhui Jia
Attack Chain Overview: Emotet in December 2020 and January 2021
Emotet
2021-02-28 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2021-02-28 ⋅ NetbyteSEC
Deobfuscating Emotet Macro Document and Powershell Command
Emotet
2021-02-25 ⋅ JPCERT/CC ⋅ Ken Sajo
Emotet Disruption and Outreach to Affected Users
Emotet
2021-02-25 ⋅ ANSSI ⋅ CERT-FR
Ryuk Ransomware
BazarBackdoor Buer Conti Emotet Ryuk TrickBot
2021-02-24 ⋅ Allsafe ⋅ Hara Hiroaki, Shota Nakajima
Malware Analysis at Scale - Defeating Emotet by Ghidra
Emotet
2021-02-24 ⋅ IBM ⋅ IBM SECURITY X-FORCE
X-Force Threat Intelligence Index 2021
Emotet QakBot Ramnit REvil TrickBot
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-02-17 ⋅ ⋅ Politie NL ⋅ Politie NL
Politie bestrijdt cybercrime via Nederlandse infrastructuur
Emotet
2021-02-17 ⋅ YouTube (AGDC Services) ⋅ AGDC Services
How Malware Can Resolve APIs By Hash
Emotet Mailto
2021-02-16 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team
Q4 2020 Threat Report: A Quarterly Analysis of Cybersecurity Trends, Tactics and Themes
Emotet Ryuk NARWHAL SPIDER TA800
2021-02-12 ⋅ CERT-FR ⋅ CERT-FR
The Malware-Aa-A-Service Emotet
Emotet
2021-02-08 ⋅ GRNET CERT ⋅ Dimitris Kolotouros, Marios Levogiannis
Reverse engineering Emotet – Our approach to protect GRNET against the trojan
Emotet
2021-02-03 ⋅ Digital Shadows ⋅ Stefano De Blasi
Emotet Disruption: what it means for the cyber threat landscape
Emotet
2021-02-02 ⋅ ⋅ CRONUP ⋅ Germán Fernández
De ataque con Malware a incidente de Ransomware
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader
2021-02-01 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team
What tracking an attacker email infrastructure tells us about persistent cybercriminal operations
Dridex Emotet Makop Ransomware SmokeLoader TrickBot
2021-01-29 ⋅ Malwarebytes ⋅ Threat Intelligence Team
Cleaning up after Emotet: the law enforcement file
Emotet
2021-01-28 ⋅ InfoSec Handlers Diary Blog ⋅ Daniel Wesemann
Emotet vs. Windows Attack Surface Reduction
Emotet
2021-01-28 ⋅ Hornetsecurity ⋅ Hornetsecurity Security Lab
Emotet Botnet Takedown
Emotet
2021-01-28 ⋅ NTT ⋅ Dan Saunders
Emotet disruption - Europol counterattack
Emotet
2021-01-28 ⋅ Youtube (Virus Bulletin) ⋅ Benoît Ancel
The Bagsu banker case
Azorult DreamBot Emotet Pony TrickBot ZeusAction
2021-01-28 ⋅ Department of Homeland Security ⋅ Department of Justice
Emotet Botnet Disrupted in International Cyber Operation
Emotet
2021-01-27 ⋅ Eurojust ⋅ Eurojust
World’s most dangerous malware EMOTET disrupted through global action
Emotet
2021-01-27 ⋅ ⋅ Bundeskriminalamt ⋅ Bundeskriminalamt
In­fra­struk­tur der Emo­tet-Schad­soft­wa­re zer­schla­gen
Emotet
2021-01-27 ⋅ ⋅ Youtube (Національна поліція України) ⋅ Національна поліція України
Кіберполіція викрила транснаціональне угруповання хакерів у розповсюдженні вірусу EMOTET
Emotet
2021-01-27 ⋅ Intel 471 ⋅ Intel 471
Emotet takedown is not like the Trickbot takedown
Emotet
2021-01-27 ⋅ Team Cymru ⋅ James Shank
Taking Down Emotet How Team Cymru Leveraged Visibility and Relationships to Coordinate Community Efforts
Emotet
2021-01-27 ⋅ Twitter (@milkr3am) ⋅ milkream
Tweet on all Emotet epoch pushing payload to self remove emotet malware on 2021-04-25
Emotet
2021-01-27 ⋅ KrebsOnSecurity ⋅ Brian Krebs
International Action Targets Emotet Crimeware
Emotet
2021-01-19 ⋅ Palo Alto Networks Unit 42 ⋅ Brad Duncan
Wireshark Tutorial: Examining Emotet Infection Traffic
Emotet GootKit IcedID QakBot TrickBot
2021-01-14 ⋅ Netskope ⋅ Dagmawi Mulugeta, Ghanashyam Satpathy
You Can Run, But You Can’t Hide: Advanced Emotet Updates
Emotet
2021-01-13 ⋅ VinCSS ⋅ m4n0w4r, Tran Trung Kien
[RE019] From A to X analyzing some real cases which used recent Emotet samples
Emotet
2021-01-09 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
Command and Control Traffic Patterns
ostap LaZagne Agent Tesla Azorult Buer Cobalt Strike DanaBot DarkComet Dridex Emotet Formbook IcedID ISFB NetWire RC PlugX Quasar RAT SmokeLoader TrickBot
2021-01-05 ⋅ r3mrum blog ⋅ R3MRUM
Manual analysis of new PowerSplit maldocs delivering Emotet
Emotet
2020-12-31 ⋅ ⋅ Cert-AgID ⋅ Cert-AgID
Simplify Emotet parsing with Python and iced x86
Emotet
2020-12-30 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
Emotet malware hits Lithuania's National Public Health Center
Emotet
2020-12-21 ⋅ Cisco Talos ⋅ JON MUNSHAW
2020: The year in malware
WolfRAT Prometei Poet RAT Agent Tesla Astaroth Ave Maria CRAT Emotet Gozi IndigoDrop JhoneRAT Nanocore RAT NjRAT Oblique RAT SmokeLoader StrongPity WastedLocker Zloader
2020-12-10 ⋅ Youtube (OALabs) ⋅ Sergei Frankoff
Malware Triage Analyzing PrnLoader Used To Drop Emotet
Emotet
2020-12-04 ⋅ Kaspersky Labs ⋅ Oleg Kupreev
The chronicles of Emotet
Emotet
2020-11-26 ⋅ VirusTotal ⋅ Emiliano Martinez
Using similarity to expand context and map out threat campaigns
Emotet
2020-11-22 ⋅ Irshad's Blog ⋅ Irshad Muhammad
Analyzing an Emotet Dropper and Writing a Python Script to Statically Unpack Payload.
Emotet
2020-11-20 ⋅ ZDNet ⋅ Catalin Cimpanu
The malware that usually installs ransomware and you need to remove right away
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DoppelPaymer Dridex Egregor Emotet FriedEx MegaCortex Phorpiex PwndLocker QakBot Ryuk SDBbot TrickBot Zloader
2020-11-18 ⋅ Cisco ⋅ Edmund Brumaghin, Jaeson Schultz, Nick Biasini
Back from vacation: Analyzing Emotet’s activity in 2020
Emotet
2020-11-06 ⋅ Security Soup Blog ⋅ Ryan Campbell
Quick Post: Spooky New PowerShell Obfuscation in Emotet Maldocs
Emotet
2020-11-06 ⋅ ⋅ LAC WATCH ⋅ Ishikawa, Matsumoto, Takagen
分析レポート：Emotetの裏で動くバンキングマルウェア「Zloader」に注意
Emotet Zloader
2020-11-05 ⋅ Brim Security ⋅ Oliver Rochford
Hunting Emotet with Brim and Zeek
Emotet
2020-10-29 ⋅ Palo Alto Networks Unit 42 ⋅ Janos Szurdi, Jingwei Fan, Ruian Duan, Seokkyung Chung, Zhanhao Chen
Domain Parking: A Gateway to Attackers Spreading Emotet and Impersonating McAfee
Emotet
2020-10-29 ⋅ CERT-FR ⋅ CERT-FR
LE MALWARE-AS-A-SERVICE EMOTET
Dridex Emotet ISFB QakBot
2020-10-28 ⋅ Bitdefender ⋅ Ruben Andrei Condor
A Decade of WMI Abuse – an Overview of Techniques in Modern Malware
sLoad Emotet Maze
2020-10-20 ⋅ ⋅ Bundesamt für Sicherheit in der Informationstechnik ⋅ BSI
Die Lage der IT-Sicherheit in Deutschland 2020
Clop Emotet REvil Ryuk TrickBot
2020-10-19 ⋅ SPAM Auditor ⋅ Thomas
The Many Faces of Emotet
Emotet
2020-10-16 ⋅ Proofpoint ⋅ Cassandra A., Proofpoint Threat Research Team
Geofenced Amazon Japan Credential Phishing Volumes Rival Emotet
Emotet
2020-10-12 ⋅ DeepInstinct ⋅ Ron Ben Yizhak
Why Emotet’s Latest Wave is Harder to Catch Than Ever Before – Part 2
Emotet
2020-10-01 ⋅ Proofpoint ⋅ Axel F, Proofpoint Threat Research Team
Emotet Makes Timely Adoption of Political and Elections Lures
Emotet
2020-09-29 ⋅ Microsoft ⋅ Microsoft
Microsoft Digital Defense Report
Emotet IcedID Mailto Maze QakBot REvil RobinHood TrickBot
2020-09-29 ⋅ Seqrite ⋅ Prashant Tilekar
The return of the Emotet as the world unlocks!
Emotet
2020-09-29 ⋅ PWC UK ⋅ Andy Auld
What's behind the increase in ransomware attacks this year?
DarkSide Avaddon Clop Conti DoppelPaymer Dridex Emotet FriedEx Mailto PwndLocker QakBot REvil Ryuk SMAUG SunCrypt TrickBot WastedLocker
2020-09-23 ⋅ paloalto Netoworks: Unit42 ⋅ Brad Duncan
Case Study: Emotet Thread Hijacking, an Email Attack Technique
Emotet
2020-09-11 ⋅ ThreatConnect ⋅ ThreatConnect Research Team
Research Roundup: Activity on Previously Identified APT33 Domains
Emotet PlugX APT33
2020-09-07 ⋅ CERT NZ ⋅ CERT NZ
Emotet Malware being spread via email
Emotet
2020-09-07 ⋅ CERT-FR ⋅ CERT-FR
Bulletin d'alerte du CERT-FR: Recrudescence d’activité Emotet en France
Emotet
2020-08-31 ⋅ Inde ⋅ Chris Campbell
Analysis of the latest wave of Emotet malicious documents
Emotet
2020-08-28 ⋅ Proofpoint ⋅ Axel F, Proofpoint Threat Research Team
A Comprehensive Look at Emotet’s Summer 2020 Return
Emotet MUMMY SPIDER
2020-08-24 ⋅ Hornetsecurity ⋅ Security Lab
Emotet Update increases Downloads
Emotet
2020-08-14 ⋅ Binary Defense ⋅ James Quinn
EmoCrash: Exploiting a Vulnerability in Emotet Malware for Defense
Emotet
2020-08-12 ⋅ DeepInstinct ⋅ Ron Ben Yizhak
Why Emotet’s Latest Wave is Harder to Catch than Ever Before
Emotet
2020-08-09 ⋅ F5 Labs ⋅ Debbie Walkowski, Remi Cohen
Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2020-08-05 ⋅ Github (mauronz) ⋅ Francesco Muroni
Emotet API+string deobfuscator (v0.1)
Emotet
2020-08-01 ⋅ ⋅ TG Soft ⋅ TG Soft
TG Soft Cyber - Threat Report
DarkComet Darktrack RAT Emotet ISFB
2020-07-31 ⋅ Hornetsecurity ⋅ Hornetsecurity Security Lab
The webshells powering Emotet
Emotet
2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader
2020-07-29 ⋅ Sophos Labs ⋅ Andrew Brandt
Emotet’s return is the canary in the coal mine
Emotet
2020-07-28 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
Emotet malware now steals your email attachments to attack contacts
Emotet
2020-07-20 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Emotet-TrickBot malware duo is back infecting Windows machines
Emotet TrickBot
2020-07-20 ⋅ NTT ⋅ Security division of NTT Ltd.
Shellbot victim overlap with Emotet network infrastructure
Emotet
2020-07-20 ⋅ Hornetsecurity ⋅ Hornetsecurity Security Lab
Emotet is back
Emotet
2020-07-17 ⋅ CERT-FR ⋅ CERT-FR
The Malware Dridex: Origins and Uses
Andromeda CryptoLocker Cutwail DoppelPaymer Dridex Emotet FriedEx Gameover P2P Gandcrab ISFB Murofet Necurs Predator The Thief Zeus
2020-06-18 ⋅ NTT Security ⋅ Security division of NTT Ltd.
Behind the scenes of the Emotet Infrastructure
Emotet
2020-06-12 ⋅ ThreatConnect ⋅ ThreatConnect Research Team
Probable Sandworm Infrastructure
Avaddon Emotet Kimsuky
2020-05-28 ⋅ VMWare Carbon Black ⋅ Ryan Murphy, Tom Kellermann
Modern Bank Heists 3.0
Emotet
2020-05-24 ⋅ Palo Alto Networks Unit 42 ⋅ Ajaya Neupane, Stefan Achleitner
Using AI to Detect Malicious C2 Traffic
Emotet Sality
2020-05-21 ⋅ PICUS Security ⋅ Süleyman Özarslan
T1055 Process Injection
BlackEnergy Cardinal RAT Downdelph Emotet Kazuar RokRAT SOUNDBITE
2020-05-05 ⋅ Hornetsecurity ⋅ Security Lab
Awaiting the Inevitable Return of Emotet
Emotet
2020-04-22 ⋅ Youtube (Infosec Alpha) ⋅ Raashid Bhat
FlattenTheCurve - Emotet Control Flow Unflattening | Episode 2
Emotet
2020-04-14 ⋅ Intel 471 ⋅ Intel 471
Understanding the relationship between Emotet, Ryuk and TrickBot
Emotet Ryuk TrickBot
2020-04-03 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
Microsoft: Emotet Took Down a Network by Overheating All Computers
Emotet
2020-03-31 ⋅ Youtube (Infosec Alpha) ⋅ Raashid Bhat
Emotet Binary Deobfuscation | Coconut Paradise | Episode 1
Emotet
2020-03-30 ⋅ Symantec ⋅ Mingwei Zhang, Nguyen Hoang Giang
Emotet: Dangerous Malware Keeps on Evolving
Emotet
2020-03-30 ⋅ Intezer ⋅ Michael Kajiloti
Fantastic payloads and where we find them
Dridex Emotet ISFB TrickBot
2020-03-12 ⋅ Digital Shadows ⋅ Alex Guirakhoo
How cybercriminals are taking advantage of COVID-19: Scams, fraud, and misinformation
Emotet
2020-03-11 ⋅ Twitter (@raashidbhatt) ⋅ Raashid Bhat
Tweet on Emotet Deobfuscation with Video
Emotet
2020-03-06 ⋅ Telekom ⋅ Thomas Barabosch
Dissecting Emotet - Part 2
Emotet
2020-03-06 ⋅ Binary Defense ⋅ James Quinn
Emotet Wi-Fi Spreader Upgraded
Emotet
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-03-02 ⋅ ⋅ c't ⋅ Christian Wölbert
Was Emotet anrichtet – und welche Lehren die Opfer daraus ziehen
Emotet Ryuk
2020-02-29 ⋅ ZDNet ⋅ Catalin Cimpanu
Meet the white-hat group fighting Emotet, the world's most dangerous malware
Emotet
2020-02-18 ⋅ CERT.PL ⋅ Michał Praszmo
What’s up Emotet?
Emotet
2020-02-13 ⋅ Talos ⋅ Edmund Brumaghin, Nick Biasini
Threat actors attempt to capitalize on coronavirus outbreak
Emotet Nanocore RAT Parallax RAT
2020-02-10 ⋅ Malwarebytes ⋅ Adam Kujawa, Chris Boyd, David Ruiz, Jérôme Segura, Jovi Umawing, Nathan Collier, Pieter Arntz, Thomas Reed, Wendy Zamora
2020 State of Malware Report
magecart Emotet QakBot REvil Ryuk TrickBot WannaCryptor
2020-02-08 ⋅ PICUS Security ⋅ Süleyman Özarslan
Emotet Technical Analysis - Part 2 PowerShell Unveiled
Emotet
2020-02-07 ⋅ Binary Defense ⋅ James Quinn
Emotet Evolves With New Wi-Fi Spreader
Emotet
2020-02-03 ⋅ Telekom ⋅ Thomas Barabosch
Dissecting Emotet – Part 1
Emotet
2020-01-30 ⋅ IBM X-Force Exchange ⋅ Ashkan Vila, Golo Mühr
Coronavirus Goes Cyber With Emotet
Emotet
2020-01-30 ⋅ PICUS Security ⋅ Süleyman Özarslan
Emotet Technical Analysis - Part 1 Reveal the Evil Code
Emotet
2020-01-27 ⋅ ⋅ T-Systems ⋅ T-Systems
Vorläufiger forensischer Abschlussbericht zur Untersuchung des Incidents beim Berliner Kammergericht
Emotet TrickBot
2020-01-17 ⋅ Hiroaki Ogawa, Manabu Niseki
100 more behind cockroaches?
MoqHao Emotet Predator The Thief
2020-01-17 ⋅ JPCERT/CC ⋅ Takayoshi Shiigi
Looking back on the incidents in 2019
TSCookie NodeRAT Emotet PoshC2 Quasar RAT
2020-01-14 ⋅ Bleeping Computer ⋅ Lawrence Abrams
United Nations Targeted With Emotet Malware Phishing Attack
Emotet
2020-01-13 ⋅ Gigamon ⋅ Ed Miles, William Peteroy
Emotet: Not your Run-of-the-mill Malware
Emotet
2020-01-10 ⋅ CSIS ⋅ CSIS
Threat Matrix H1 2019
Gustuff magecart Emotet Gandcrab Ramnit TrickBot
2020-01-07 ⋅ Hatching.io ⋅ Team
Powershell Static Analysis & Emotet results
Emotet
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
GOLD CRESTWOOD
Emotet MUMMY SPIDER
2019-12-12 ⋅ FireEye ⋅ Chi-en Shen, Oleg Bondarenko
Cyber Threat Landscape in Japan – Revealing Threat in the Shadow
Cerberus TSCookie Cobalt Strike Dtrack Emotet Formbook IcedID Icefog IRONHALO Loki Password Stealer (PWS) PandaBanker PLEAD poisonplug TrickBot BlackTech
2019-12-10 ⋅ JPCERT/CC ⋅ JPCERT/CC
[Updated] Alert Regarding Emotet Malware Infection
Emotet
2019-12-07 ⋅ Secureworks ⋅ Keith Jarvis, Kevin O’Reilly
End-to-end Botnet Monitoring... Botconf 2019
Emotet ISFB QakBot
2019-12-04 ⋅ JPCERT/CC ⋅ Ken Sajo
How to Respond to Emotet Infection (FAQ)
Emotet
2019-11-06 ⋅ ⋅ Heise Security ⋅ Thomas Hungenberg
Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail
Emotet Ryuk TrickBot
2019-10-30 ⋅ Zscaler ⋅ Abhay Yadav, Atinderpal Singh
Emotet is back in action after a short break
Emotet
2019-10-14 ⋅ Marco Ramilli
Is Emotet gang targeting companies with external SOC?
Emotet
2019-09-24 ⋅ Dissecting Malware ⋅ Marius Genheimer
Return of the Mummy - Welcome back, Emotet
Emotet
2019-09-16 ⋅ Malwarebytes ⋅ Threat Intelligence Team
Emotet is back: botnet springs back to life with new spam campaign
Emotet
2019-08-13 ⋅ Adalogics ⋅ David Korczynski
The state of advanced code injections
Dridex Emotet Tinba
2019-08-12 ⋅ ⋅ Schweizerische Eidgenossenschaft ⋅ Schweizerische Eidgenossenschaft
Trojaner Emotet greift Unternehmensnetzwerke an
Emotet
2019-06-06 ⋅ Fortinet ⋅ Kai Lu
A Deep Dive into the Emotet Malware
Emotet
2019-05-15 ⋅ Proofpoint ⋅ Axel F, Proofpoint Threat Insight Team
Threat Actor Profile: TA542, From Banker to Malware Distribution Service
Emotet MUMMY SPIDER
2019-05-09 ⋅ GovCERT.ch ⋅ GovCERT.ch
Severe Ransomware Attacks Against Swiss SMEs
Emotet LockerGoga Ryuk TrickBot
2019-04-29 ⋅ Blueliv ⋅ Blueliv Labs Team
Where is Emotet? Latest geolocation data
Emotet
2019-04-25 ⋅ Trend Micro ⋅ Trendmicro
Emotet Adds New Evasion Technique
Emotet
2019-04-22 ⋅ int 0xcc blog ⋅ Raashid Bhat
Dissecting Emotet’s network communication protocol
Emotet
2019-04-12 ⋅ SpamTitan ⋅ titanadmin
Emotet Malware Revives Old Email Conversations Threads to Increase Infection Rates
Emotet
2019-04-07 ⋅ Sveatoslav Persianov
Emotet malware analysis. Part 2
Emotet
2019-04-01 ⋅ Cafe Babe
Analyzing Emotet with Ghidra — Part 1
Emotet
2019-03-27 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Emotet adds a further layer of camouflage
Emotet
2019-03-17 ⋅ Persianov on Security ⋅ Sveatoslav Persianov
Emotet malware analysis. Part 1
Emotet
2019-03-15 ⋅ Cofense ⋅ Threat Intelligence
Flash Bulletin: Emotet Epoch 1 Changes its C2 Communication
Emotet
2019-03-08 ⋅ The Daily Swig ⋅ James Walker
Emotet trojan implicated in Wolverine Solutions ransomware attack
Emotet
2019-02-16 ⋅ Max Kersten's Blog ⋅ Max Kersten
Emotet droppers
Emotet
2019-01-17 ⋅ SANS ISC InfoSec Forums ⋅ Brad Duncan
Emotet infections and follow-up malware
Emotet
2019-01-05 ⋅ Github (d00rt) ⋅ d00rt
Emotet Research
Emotet
2019-01-01 ⋅ D00RT_RM
Emutet
Emotet
2018-12-18 ⋅ Trend Micro ⋅ Trendmicro
URSNIF, EMOTET, DRIDEX and BitPaymer Gangs Linked by a Similar Loader
Dridex Emotet FriedEx ISFB
2018-11-16 ⋅ Trend Micro ⋅ Trend Micro
Exploring Emotet: Examining Emotet’s Activities, Infrastructure
Emotet
2018-11-09 ⋅ ESET Research ⋅ ESET Research
Emotet launches major new spam campaign
Emotet
2018-10-31 ⋅ Kryptos Logic ⋅ Kryptos Logic
Emotet Awakens With New Campaign of Mass Email Exfiltration
Emotet
2018-09-12 ⋅ Cryptolaemus Pastedump ⋅ Cryptolaemus
Emotet IOC
Emotet
2018-08-01 ⋅ Kryptos Logic ⋅ Kryptos Logic
Inside Look at Emotet's Global Victims and Malspam Qakbot Payloads
Emotet
2018-07-26 ⋅ Intezer ⋅ Itai Tevet
Mitigating Emotet, The Most Common Banking Trojan
Emotet
2018-07-24 ⋅ Check Point ⋅ Ben Herzog, Ofer Caspi
Emotet: The Tricky Trojan that ‘Git Clones’
Emotet
2018-07-23 ⋅ MalFind ⋅ Lasq
Deobfuscating Emotet’s powershell payload
Emotet
2018-07-20 ⋅ NCCIC ⋅ Communications Integration Center, National Cybersecurity
Alert (TA18-201A) Emotet Malware
Emotet
2018-07-18 ⋅ Symantec ⋅ Security Response Attack Investigation Team
The Evolution of Emotet: From Banking Trojan to Threat Distributor
Emotet
2018-02-08 ⋅ CrowdStrike ⋅ Adam Meyers
Meet CrowdStrike’s Adversary of the Month for February: MUMMY SPIDER
Emotet MUMMY SPIDER
2018-01-12 ⋅ Proofpoint ⋅ Proofpoint Staff
Holiday lull? Not so much
Dridex Emotet GlobeImposter ISFB Necurs PandaBanker UrlZone NARWHAL SPIDER
2018-01-01 ⋅ Quick Heal ⋅ Quick Heal
The Complete story of EMOTET Most prominent Malware of 2018
Emotet
2017-11-15 ⋅ Trend Micro ⋅ Rubio Wu
New EMOTET Hijacks a Windows API, Evades Sandbox and Analysis
Emotet
2017-11-06 ⋅ Microsoft ⋅ Microsoft Defender ATP Research Team
Mitigating and eliminating info-stealing Qakbot and Emotet in corporate networks
Emotet
2017-11-06 ⋅ Microsoft ⋅ Microsoft Defender ATP Research Team
Mitigating and eliminating info-stealing Qakbot and Emotet in corporate networks
Emotet QakBot
2017-10-12 ⋅ G Data ⋅ G Data
Emotet beutet Outlook aus
Emotet
2017-10-06 ⋅ CERT.PL ⋅ Jarosław Jedynak, Maciej Kotowicz
Peering into spam botnets
Emotet Kelihos Necurs SendSafe Tofsee
2017-09-07 ⋅ Trend Micro ⋅ Don Ladores
EMOTET Returns, Starts Spreading via Spam Botnet
Emotet
2017-07-17 ⋅ Malwarebytes ⋅ Threat Intelligence Team
It’s baaaack: Public cyber enemy Emotet has returned
Emotet
2017-05-31 ⋅ ropgadget.com ⋅ Jeff White
Writing PCRE's for applied passive network defense [Emotet]
Emotet
2017-05-24 ⋅ CERT.PL ⋅ Paweł Srokosz
Analysis of Emotet v4
Emotet
2017-05-03 ⋅ Fortinet ⋅ Xiaopeng Zhang
Deep Analysis of New Emotet Variant - Part 1
Emotet
2015-04-09 ⋅ Kaspersky Labs ⋅ Alexey Shulmin
The Banking Trojan Emotet: Detailed Analysis
Emotet
2013-01-18 ⋅ abuse.ch ⋅ abuse.ch
Feodo Tracker
Emotet
Yara Rules
[TLP:WHITE] win_emotet_auto (20230808 | Detects win.emotet.)
rule win_emotet_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.emotet."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3c41 7c04 3c5a 7e03 c60158 }
            // n = 5, score = 2900
            //   3c41                 | cmp                 al, 0x41
            //   7c04                 | jl                  6
            //   3c5a                 | cmp                 al, 0x5a
            //   7e03                 | jle                 5
            //   c60158               | mov                 byte ptr [ecx], 0x58

        $sequence_1 = { 7e13 3c61 7c04 3c7a 7e0b 3c41 7c04 }
            // n = 7, score = 2900
            //   7e13                 | jle                 0x15
            //   3c61                 | cmp                 al, 0x61
            //   7c04                 | jl                  6
            //   3c7a                 | cmp                 al, 0x7a
            //   7e0b                 | jle                 0xd
            //   3c41                 | cmp                 al, 0x41
            //   7c04                 | jl                  6

        $sequence_2 = { 3c30 7c04 3c39 7e13 3c61 }
            // n = 5, score = 2900
            //   3c30                 | cmp                 al, 0x30
            //   7c04                 | jl                  6
            //   3c39                 | cmp                 al, 0x39
            //   7e13                 | jle                 0x15
            //   3c61                 | cmp                 al, 0x61

        $sequence_3 = { c60158 41 803900 75dd }
            // n = 4, score = 2400
            //   c60158               | mov                 byte ptr [ecx], 0x58
            //   41                   | inc                 ecx
            //   803900               | cmp                 byte ptr [ecx], 0
            //   75dd                 | jne                 0xffffffdf

        $sequence_4 = { 33c0 3903 5f 5e 0f95c0 5b 8be5 }
            // n = 7, score = 2400
            //   33c0                 | xor                 eax, eax
            //   3903                 | cmp                 dword ptr [ebx], eax
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   0f95c0               | setne               al
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp

        $sequence_5 = { 83c020 eb03 0fb7c0 69d23f000100 }
            // n = 4, score = 2300
            //   83c020               | add                 eax, 0x20
            //   eb03                 | jmp                 5
            //   0fb7c0               | movzx               eax, ax
            //   69d23f000100         | imul                edx, edx, 0x1003f

        $sequence_6 = { c1e808 8d5204 c1e910 8842fd 884afe }
            // n = 5, score = 2100
            //   c1e808               | cmp                 al, 0x41
            //   8d5204               | jl                  0xc
            //   c1e910               | cmp                 al, 0x5a
            //   8842fd               | cmp                 al, 0x7a
            //   884afe               | jle                 0xd

        $sequence_7 = { 880a 8bc1 c1e808 8d5204 }
            // n = 4, score = 2100
            //   880a                 | jle                 0x17
            //   8bc1                 | cmp                 al, 0x39
            //   c1e808               | jle                 0x15
            //   8d5204               | cmp                 al, 0x61

        $sequence_8 = { 8d5801 f6c30f 7406 83e3f0 }
            // n = 4, score = 2000
            //   8d5801               | lea                 ebx, [eax + 1]
            //   f6c30f               | test                bl, 0xf
            //   7406                 | je                  8
            //   83e3f0               | and                 ebx, 0xfffffff0

        $sequence_9 = { 8b4604 8b16 8945fc 8d45f8 }
            // n = 4, score = 1900
            //   8b4604               | mov                 eax, dword ptr [esi + 4]
            //   8b16                 | mov                 edx, dword ptr [esi]
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8d45f8               | lea                 eax, [ebp - 8]

        $sequence_10 = { 83c410 8b45fc 0106 294604 }
            // n = 4, score = 1900
            //   83c410               | push                esi
            //   8b45fc               | push                esi
            //   0106                 | push                eax
            //   294604               | push                esi

        $sequence_11 = { 03878c000000 50 ff15???????? 017758 }
            // n = 4, score = 1900
            //   03878c000000         | cmp                 dword ptr [ebx], eax
            //   50                   | pop                 edi
            //   ff15????????         |                     
            //   017758               | pop                 esi

        $sequence_12 = { 8bfa 8bf1 ff15???????? 8b17 83c40c }
            // n = 5, score = 1900
            //   8bfa                 | push                esi
            //   8bf1                 | push                0xf0000040
            //   ff15????????         |                     
            //   8b17                 | push                0x18
            //   83c40c               | xor                 esi, esi

        $sequence_13 = { 8945fc 8d45f8 6a04 50 ff760c }
            // n = 5, score = 1900
            //   8945fc               | push                dword ptr [ebp - 4]
            //   8d45f8               | push                0x400
            //   6a04                 | push                0
            //   50                   | push                0
            //   ff760c               | sub                 esp, 8

        $sequence_14 = { 8b17 83c40c 8b4d0c 8bc2 0bc1 83f8ff }
            // n = 6, score = 1900
            //   8b17                 | movzx               eax, ax
            //   83c40c               | add                 eax, 0x20
            //   8b4d0c               | jmp                 0xb
            //   8bc2                 | movzx               eax, ax
            //   0bc1                 | imul                edx, edx, 0x1003f
            //   83f8ff               | add                 eax, 0x20

        $sequence_15 = { c745fc04000000 50 8d45f8 81ca00000020 50 52 51 }
            // n = 7, score = 1800
            //   c745fc04000000       | cmp                 al, 0x39
            //   50                   | jle                 0x15
            //   8d45f8               | cmp                 al, 0x61
            //   81ca00000020         | jl                  0xa
            //   50                   | cmp                 al, 0x7a
            //   52                   | jle                 0x15
            //   51                   | cmp                 al, 0x41

        $sequence_16 = { 66c1e808 4d8d4004 418840fd 418848fe }
            // n = 4, score = 1700
            //   66c1e808             | mov                 dword ptr [eax + 0x10], edx
            //   4d8d4004             | dec                 esp
            //   418840fd             | mov                 dword ptr [eax + 0x18], eax
            //   418848fe             | dec                 esp

        $sequence_17 = { 418848fe 66c1e908 418848ff 4d3bd9 72cf }
            // n = 5, score = 1700
            //   418848fe             | inc                 ecx
            //   66c1e908             | mov                 byte ptr [eax - 2], cl
            //   418848ff             | shr                 cx, 8
            //   4d3bd9               | inc                 ecx
            //   72cf                 | mov                 byte ptr [eax - 1], cl

        $sequence_18 = { 2bca d1e9 03ca c1e906 894c2430 }
            // n = 5, score = 1700
            //   2bca                 | lea                 eax, [eax + 4]
            //   d1e9                 | inc                 ecx
            //   03ca                 | mov                 byte ptr [eax - 3], al
            //   c1e906               | inc                 ecx
            //   894c2430             | mov                 byte ptr [eax - 2], cl

        $sequence_19 = { 418bd0 d3e2 418bcb d3e0 }
            // n = 4, score = 1700
            //   418bd0               | cmp                 ebx, ecx
            //   d3e2                 | jb                  0xffffffe8
            //   418bcb               | dec                 ebp
            //   d3e0                 | lea                 eax, [eax + 4]

        $sequence_20 = { 488bd3 488bcf 488b5c2460 4883c450 }
            // n = 4, score = 1700
            //   488bd3               | mov                 dword ptr [esp + 0x30], ecx
            //   488bcf               | inc                 ecx
            //   488b5c2460           | mov                 byte ptr [eax - 2], cl
            //   4883c450             | shr                 cx, 8

        $sequence_21 = { d3e7 83f841 7208 83f85a }
            // n = 4, score = 1700
            //   d3e7                 | jle                 9
            //   83f841               | mov                 byte ptr [ecx], 0x58
            //   7208                 | jl                  6
            //   83f85a               | cmp                 al, 0x39

        $sequence_22 = { 418808 0fb7c1 c1e910 66c1e808 }
            // n = 4, score = 1700
            //   418808               | ret                 
            //   0fb7c1               | dec                 eax
            //   c1e910               | mov                 dword ptr [eax + 8], ecx
            //   66c1e808             | dec                 eax

        $sequence_23 = { 49895b08 49896b10 49897318 49897b20 4156 4883ec70 }
            // n = 6, score = 1700
            //   49895b08             | inc                 ecx
            //   49896b10             | mov                 byte ptr [eax - 1], cl
            //   49897318             | sub                 ecx, edx
            //   49897b20             | shr                 ecx, 1
            //   4156                 | add                 ecx, edx
            //   4883ec70             | shr                 ecx, 6

        $sequence_24 = { 48895010 4c894018 4c894820 c3 }
            // n = 4, score = 1700
            //   48895010             | dec                 ebp
            //   4c894018             | cmp                 ebx, ecx
            //   4c894820             | jb                  0xffffffd4
            //   c3                   | dec                 eax

        $sequence_25 = { c1e807 46 83f87f 77f7 }
            // n = 4, score = 1600
            //   c1e807               | dec                 eax
            //   46                   | mov                 dword ptr [eax + 0x10], edx
            //   83f87f               | dec                 esp
            //   77f7                 | mov                 dword ptr [eax + 0x18], eax

        $sequence_26 = { 84c0 75f2 eb03 c60100 }
            // n = 4, score = 1500
            //   84c0                 | mov                 dword ptr [eax + 8], ecx
            //   75f2                 | dec                 eax
            //   eb03                 | mov                 dword ptr [eax + 0x10], edx
            //   c60100               | dec                 esp

        $sequence_27 = { f7e1 b84fecc44e 2bca d1e9 }
            // n = 4, score = 1500
            //   f7e1                 | cmp                 al, 0x39
            //   b84fecc44e           | jle                 0x15
            //   2bca                 | cmp                 al, 0x61
            //   d1e9                 | jl                  0xa

        $sequence_28 = { 8bd3 8b0f e8???????? 85c0 }
            // n = 4, score = 1400
            //   8bd3                 | cmp                 al, 0x39
            //   8b0f                 | jle                 0x17
            //   e8????????           |                     
            //   85c0                 | cmp                 al, 0x61

        $sequence_29 = { 7423 8a01 3c30 7c04 }
            // n = 4, score = 1300
            //   7423                 | jl                  0xe
            //   8a01                 | cmp                 al, 0x41
            //   3c30                 | jl                  6
            //   7c04                 | cmp                 al, 0x5a

        $sequence_30 = { 83c104 894e04 8b00 85c0 }
            // n = 4, score = 1200
            //   83c104               | jle                 7
            //   894e04               | mov                 byte ptr [ecx], 0x58
            //   8b00                 | cmp                 al, 0x7a
            //   85c0                 | jle                 0xd

        $sequence_31 = { 7907 83c107 3bf7 72e8 }
            // n = 4, score = 1200
            //   7907                 | shr                 cx, 8
            //   83c107               | inc                 ecx
            //   3bf7                 | mov                 byte ptr [eax - 1], cl
            //   72e8                 | dec                 ebp

        $sequence_32 = { 56 57 6a1e 8d45e0 }
            // n = 4, score = 1100
            //   56                   | sub                 dword ptr [esi + 4], eax
            //   57                   | mov                 esi, ecx
            //   6a1e                 | mov                 edx, dword ptr [edi]
            //   8d45e0               | add                 esp, 0xc

        $sequence_33 = { 52 52 52 52 68???????? 52 }
            // n = 6, score = 1100
            //   52                   | cmp                 ebx, ecx
            //   52                   | jb                  0xffffffd4
            //   52                   | dec                 ebp
            //   52                   | lea                 eax, [eax + 4]
            //   68????????           |                     
            //   52                   | inc                 ecx

        $sequence_34 = { 83ec48 53 56 57 6a44 }
            // n = 5, score = 1100
            //   83ec48               | cmp                 eax, 0x7f
            //   53                   | jbe                 0xe
            //   56                   | shr                 eax, 7
            //   57                   | inc                 ecx
            //   6a44                 | cmp                 eax, 0x7f

        $sequence_35 = { 83f87f 760d 8d642400 c1e807 }
            // n = 4, score = 1000
            //   83f87f               | shr                 ax, 8
            //   760d                 | dec                 ebp
            //   8d642400             | lea                 eax, [eax + 4]
            //   c1e807               | inc                 ecx

        $sequence_36 = { 83f87f 7609 c1e807 41 83f87f 77f7 }
            // n = 6, score = 900
            //   83f87f               | inc                 ecx
            //   7609                 | mov                 edx, eax
            //   c1e807               | shl                 edx, cl
            //   41                   | inc                 ecx
            //   83f87f               | mov                 ecx, ebx
            //   77f7                 | shl                 eax, cl

        $sequence_37 = { 6a00 6aff 50 51 ff15???????? }
            // n = 5, score = 800
            //   6a00                 | mov                 byte ptr [eax], cl
            //   6aff                 | movzx               eax, cx
            //   50                   | shr                 ecx, 0x10
            //   51                   | shr                 ax, 8
            //   ff15????????         |                     

        $sequence_38 = { 50 6a00 6a01 6a00 ff15???????? a3???????? }
            // n = 6, score = 800
            //   50                   | movzx               eax, cx
            //   6a00                 | shr                 ecx, 0x10
            //   6a01                 | shr                 ax, 8
            //   6a00                 | inc                 ecx
            //   ff15????????         |                     
            //   a3????????           |                     

        $sequence_39 = { 6a00 ff75fc 6800040000 6a00 6a00 6a00 }
            // n = 6, score = 600
            //   6a00                 | mov                 dword ptr [esi + 0x20], ecx
            //   ff75fc               | add                 esp, 0x18
            //   6800040000           | pop                 esi
            //   6a00                 | ret                 
            //   6a00                 | mov                 ebx, ecx
            //   6a00                 | add                 ebx, 0x10

        $sequence_40 = { 50 56 6800800000 6a6a }
            // n = 4, score = 600
            //   50                   | shr                 eax, 7
            //   56                   | inc                 ecx
            //   6800800000           | cmp                 eax, 0x7f
            //   6a6a                 | mov                 ecx, 1

        $sequence_41 = { 53 56 8bf1 bb00c34c84 }
            // n = 4, score = 600
            //   53                   | ja                  5
            //   56                   | jbe                 0xb
            //   8bf1                 | shr                 eax, 7
            //   bb00c34c84           | inc                 ecx

        $sequence_42 = { 56 68400000f0 6a18 33f6 56 56 }
            // n = 6, score = 600
            //   56                   | add                 ebx, 0x3c
            //   68400000f0           | mov                 dword ptr [edx + 4], esi
            //   6a18                 | mov                 dword ptr [edx], esi
            //   33f6                 | mov                 dword ptr [esp + 0x7c], eax
            //   56                   | movsd               qword ptr [esp + 0x70], xmm0
            //   56                   | mov                 ecx, dword ptr [edx + 0x48]

        $sequence_43 = { 55 89e5 648b0d18000000 8b4130 83b8a400000006 }
            // n = 5, score = 500
            //   55                   | mov                 dword ptr [esi + 0x34], ebx
            //   89e5                 | mov                 dword ptr [esp], eax
            //   648b0d18000000       | mov                 eax, dword ptr [esp + 0x50]
            //   8b4130               | mov                 dword ptr [esp + 0x14], ecx
            //   83b8a400000006       | mov                 ecx, dword ptr [esp + 0x18]

        $sequence_44 = { 8b5508 befbffffff c600e9 29d6 01ce 897001 }
            // n = 6, score = 500
            //   8b5508               | and                 ebx, 0xfffffff0
            //   befbffffff           | lea                 ebx, [eax + 1]
            //   c600e9               | test                bl, 0xf
            //   29d6                 | je                  0xb
            //   01ce                 | and                 ebx, 0xfffffff0
            //   897001               | add                 ebx, 0x10

        $sequence_45 = { 50 51 52 01c8 01d0 }
            // n = 5, score = 500
            //   50                   | mov                 ebx, 0x844cc300
            //   51                   | push                edi
            //   52                   | xor                 edi, edi
            //   01c8                 | push                ebx
            //   01d0                 | push                esi

        $sequence_46 = { 8b7d08 83fe00 8945f0 894dec }
            // n = 4, score = 500
            //   8b7d08               | push                esi
            //   83fe00               | push                eax
            //   8945f0               | mov                 eax, dword ptr [edi + 0x74]
            //   894dec               | add                 eax, dword ptr [edi + 0x8c]

        $sequence_47 = { 89d6 83c60c 8b7df4 8b4c0f0c }
            // n = 4, score = 500
            //   89d6                 | imul                edx, edx, 0x1003f
            //   83c60c               | add                 eax, 0x20
            //   8b7df4               | jmp                 8
            //   8b4c0f0c             | movzx               eax, ax

        $sequence_48 = { 8bec 83ec08 56 57 8bf1 33ff }
            // n = 6, score = 500
            //   8bec                 | push                0
            //   83ec08               | push                1
            //   56                   | push                0
            //   57                   | push                esi
            //   8bf1                 | mov                 edi, eax
            //   33ff                 | test                edi, edi

        $sequence_49 = { 51 8d4df8 51 ff75f8 50 6a03 6a30 }
            // n = 7, score = 500
            //   51                   | push                -1
            //   8d4df8               | push                eax
            //   51                   | push                ecx
            //   ff75f8               | push                eax
            //   50                   | push                0
            //   6a03                 | push                1
            //   6a30                 | push                0

        $sequence_50 = { 8b466c 5f 5e 5b 8be5 5d }
            // n = 6, score = 500
            //   8b466c               | cmp                 eax, 0x7f
            //   5f                   | push                0
            //   5e                   | push                -1
            //   5b                   | push                eax
            //   8be5                 | push                ecx
            //   5d                   | push                eax

        $sequence_51 = { 8b5d08 b8afa96e5e 56 57 00b807000000 008b45fc33d2 00b871800780 }
            // n = 7, score = 500
            //   8b5d08               | mov                 edx, dword ptr [edi]
            //   b8afa96e5e           | add                 esp, 0xc
            //   56                   | mov                 ecx, dword ptr [ebp + 0xc]
            //   57                   | mov                 eax, edx
            //   00b807000000         | or                  eax, ecx
            //   008b45fc33d2         | cmp                 eax, -1
            //   00b871800780         | test                eax, eax

        $sequence_52 = { 8bf1 bb00c34c84 57 33ff }
            // n = 4, score = 500
            //   8bf1                 | mov                 edx, esp
            //   bb00c34c84           | xor                 esi, esi
            //   57                   | mov                 dword ptr [edx + 0xc], esi
            //   33ff                 | mov                 dword ptr [edx + 8], esi

        $sequence_53 = { 83ec10 53 6a00 8d45fc }
            // n = 4, score = 500
            //   83ec10               | mov                 dword ptr [esp + 4], ecx
            //   53                   | mov                 ecx, dword ptr [esp + 0x1c]
            //   6a00                 | cmove               ecx, eax
            //   8d45fc               | sub                 edx, dword ptr [ecx + 0x34]

        $sequence_54 = { 6a03 6a00 6a00 ff7508 53 50 }
            // n = 6, score = 500
            //   6a03                 | xor                 esi, esi
            //   6a00                 | mov                 dword ptr [edx + 0xc], esi
            //   6a00                 | mov                 dword ptr [edx + 8], esi
            //   ff7508               | xor                 ecx, ecx
            //   53                   | mov                 edx, esp
            //   50                   | xor                 esi, esi

        $sequence_55 = { 8b7020 8b7840 89c3 83c33c }
            // n = 4, score = 300
            //   8b7020               | shr                 eax, 7
            //   8b7840               | shr                 eax, 7
            //   89c3                 | inc                 ebx
            //   83c33c               | cmp                 eax, 0x7f

        $sequence_56 = { c605????????00 0fb6d8 e8???????? 0fb6c3 }
            // n = 4, score = 200
            //   c605????????00       |                     
            //   0fb6d8               | add                 ecx, edx
            //   e8????????           |                     
            //   0fb6c3               | shr                 ecx, 6

        $sequence_57 = { e8???????? 84c0 7519 33c9 }
            // n = 4, score = 200
            //   e8????????           |                     
            //   84c0                 | shl                 eax, cl
            //   7519                 | sub                 ecx, edx
            //   33c9                 | shr                 ecx, 1

        $sequence_58 = { ff15???????? 83f803 7405 83f802 751e }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   83f803               | inc                 ecx
            //   7405                 | mov                 ecx, ebx
            //   83f802               | shl                 eax, cl
            //   751e                 | add                 edx, eax

        $sequence_59 = { 7519 33c9 0f1f4000 0fb6840c30010000 }
            // n = 4, score = 200
            //   7519                 | inc                 ecx
            //   33c9                 | mov                 byte ptr [eax - 3], al
            //   0f1f4000             | inc                 ecx
            //   0fb6840c30010000     | mov                 byte ptr [eax - 2], cl

        $sequence_60 = { 743e 8b5c2430 85db 741d }
            // n = 4, score = 200
            //   743e                 | mov                 dword ptr [ebp + 0x20], ecx
            //   8b5c2430             | inc                 ecx
            //   85db                 | mov                 edx, eax
            //   741d                 | shl                 edx, cl

        $sequence_61 = { 8bf8 e8???????? eb04 8b7c2430 }
            // n = 4, score = 200
            //   8bf8                 | shl                 edx, cl
            //   e8????????           |                     
            //   eb04                 | inc                 ecx
            //   8b7c2430             | mov                 ecx, ebx

        $sequence_62 = { 31c9 89e2 31f6 89720c 897208 }
            // n = 5, score = 200
            //   31c9                 | ja                  0
            //   89e2                 | shr                 eax, 7
            //   31f6                 | inc                 edi
            //   89720c               | cmp                 eax, 0x7f
            //   897208               | ja                  0

        $sequence_63 = { 488d15e70f0000 e8???????? 84c0 0f84f1000000 48899c2480030000 }
            // n = 5, score = 100
            //   488d15e70f0000       | inc                 ecx
            //   e8????????           |                     
            //   84c0                 | mov                 byte ptr [eax - 2], cl
            //   0f84f1000000         | shr                 cx, 8
            //   48899c2480030000     | inc                 ecx

        $sequence_64 = { 84c0 7466 0f1f4000 488b9c2448040000 4885db }
            // n = 5, score = 100
            //   84c0                 | cmp                 ebx, ecx
            //   7466                 | dec                 ebp
            //   0f1f4000             | lea                 eax, [eax + 4]
            //   488b9c2448040000     | inc                 ecx
            //   4885db               | mov                 byte ptr [eax - 3], al

        $sequence_65 = { 8b4a48 894e20 83c418 5e c3 }
            // n = 5, score = 100
            //   8b4a48               | setne               al
            //   894e20               | pop                 ebx
            //   83c418               | mov                 esp, ebp
            //   5e                   | add                 eax, 0x20
            //   c3                   | jmp                 5

        $sequence_66 = { 8b4c241c 0f44c8 2b5134 8b442420 890424 89542404 894c2418 }
            // n = 7, score = 100
            //   8b4c241c             | inc                 ecx
            //   0f44c8               | cmp                 eax, 0x7f
            //   2b5134               | ja                  5
            //   8b442420             | jbe                 0xb
            //   890424               | shr                 eax, 7
            //   89542404             | inc                 ecx
            //   894c2418             | cmp                 eax, 0x7f

        $sequence_67 = { 897204 8932 8b15???????? 8944247c f20f11442470 }
            // n = 5, score = 100
            //   897204               | mov                 esp, ebp
            //   8932                 | cmp                 dword ptr [ebx], eax
            //   8b15????????         |                     
            //   8944247c             | pop                 edi
            //   f20f11442470         | pop                 esi

        $sequence_68 = { 813c3850450000 0f44f5 895e34 890424 }
            // n = 4, score = 100
            //   813c3850450000       | push                1
            //   0f44f5               | push                0
            //   895e34               | push                esi
            //   890424               | mov                 edi, eax

        $sequence_69 = { e8???????? 8d0d2231d800 890424 894c2404 e8???????? 8b4c242c 894130 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8d0d2231d800         | inc                 ecx
            //   890424               | mov                 ecx, 1
            //   894c2404             | cmp                 eax, 0x7f
            //   e8????????           |                     
            //   8b4c242c             | jbe                 0xe
            //   894130               | shr                 eax, 7

        $sequence_70 = { 8bf8 85ff 7443 be???????? e8???????? }
            // n = 5, score = 100
            //   8bf8                 | movzx               eax, cx
            //   85ff                 | shr                 ecx, 0x10
            //   7443                 | shr                 ax, 8
            //   be????????           |                     
            //   e8????????           |                     

        $sequence_71 = { 8b442450 894c2414 8b4c2418 8908 }
            // n = 4, score = 100
            //   8b442450             | test                edi, edi
            //   894c2414             | je                  0x41
            //   8b4c2418             | push                ebx
            //   8908                 | xor                 eax, eax

        $sequence_72 = { 8b5010 51 52 c745f48072e601 e8???????? 8bd8 85db }
            // n = 7, score = 100
            //   8b5010               | mov                 byte ptr [eax], cl
            //   51                   | movzx               eax, cx
            //   52                   | shr                 ecx, 0x10
            //   c745f48072e601       | shr                 ax, 8
            //   e8????????           |                     
            //   8bd8                 | inc                 ecx
            //   85db                 | mov                 byte ptr [eax], cl

    condition:
        7 of them and filesize < 733184
}
[TLP:WHITE] win_emotet_w0   (20210421 | The modified emotet binary replaces the original emotet on the system of the victim. The original emotet is copied to a quarantine for evidence-preservation.)
rule win_emotet_w0 {
    meta:
        author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
        source = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
        description = "The modified emotet binary replaces the original emotet on the system of the victim. The original emotet is copied to a quarantine for evidence-preservation."
        note = "The quarantine folder depends on the scope of the initial emotet infection (user or administrator). It is the temporary folder as returned by GetTempPathW under a filename starting with UDP as returned by GetTempFileNameW. To prevent accidental reinfection by a user, the quarantined emotet is encrypted using RC4 and a 0x20 bytes long key found at the start of the quarantined file (see $key)."
        sharing = "TLP:WHITE"
        version = "20210323"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
        malpedia_rule_date = "20210421"
        malpedia_hash = ""
        malpedia_version = "20210421"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
    condition:
        $key at 0
}
[TLP:WHITE] win_emotet_w1   (20210421 | This rule targets a modified emotet binary deployed by the Bundeskriminalamt on the 26th of January 2021.)
rule win_emotet_w1 {
    meta:
        author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
        source = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
        description = "This rule targets a modified emotet binary deployed by the Bundeskriminalamt on the 26th of January 2021."
        note = "The binary will replace the original emotet by copying it to a quarantine. It also contains a routine to perform a self-deinstallation on the 25th of April 2021. The three-month timeframe between rollout and self- deinstallation was chosen primarily for evidence purposes as well as to allow remediation."
        sharing = "TLP:WHITE"
        version = "20210323"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
        malpedia_rule_date = "20210421"
        malpedia_hash = ""
        malpedia_version = "20210421"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
    condition:
        filesize >  300KB and
        filesize < 700KB and
        uint16(0) == 0x5A4D and
        $key
}
Download all Yara Rules