Quick Post: Host Artifacts from a Recent Emotet Infection

Quick Post: Host Artifacts from a Recent Emotet Infection

Summary If you’ve been following malware threats and/or the information security happenings of the past couple weeks in general, then you are likely aware that Emotet, everyone’s favorite malware downloader, has returned to active spamming operations. There has been a ton of great coverage on many aspects of its return to active campaigns. Shameless plug:…

Analysis of a New Emotet Maldoc with VBA Downloader

Analysis of a New Emotet Maldoc with VBA Downloader

Summary Emotet is a modular delivery platform that has consistently dominated the commodity malware threat landscape over the past couple of years. It has evolved from a straightforward banking trojan into a full-fledged malware distribution service, delivering a variety of payloads for other threat actor groups. The U.S. Department of Homeland Security states that Emotet…

FlawedAmmyy RAT & Excel 4.0 Macros

FlawedAmmyy RAT & Excel 4.0 Macros

Summary According to Proofpoint’s Q4 2018 Quarterly Threat Report, the volume of Remote Access Tools (RATs) significantly increased from 2017 to 2018. Previously, RATs only accounted for just .04% of all observed malware in the email channel. However, by Q4 of 2018, this figure increased to over 8%, and a RAT variant known as FlawedAmmyy…

A Quick Look at Emotet’s Updated JavaScript Dropper

A Quick Look at Emotet’s Updated JavaScript Dropper

Summary Emotet is an advanced, modular downloader that primarily functions as a dropper of other opportunistic malware variants. Emotet continues to be among the most widely distributed and destructive malware variants affecting organizations throughout the private and public sectors. In a previous joint Technical Alert, US-CERT identified that Emotet infections have cost organizations up to…