{"id":135,"date":"2022-07-01T19:08:54","date_gmt":"2022-07-01T19:08:54","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=135"},"modified":"2022-07-01T19:08:54","modified_gmt":"2022-07-01T19:08:54","slug":"beware-of-emotet","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2022\/07\/01\/beware-of-emotet\/","title":{"rendered":"Beware of Emotet"},"content":{"rendered":"

The origin of Emotet<\/h1>\n

Emotet<\/em>, also known as Geodo<\/em> and Heodo<\/em>, is a trojan aimed at all types of users, from ordinary users to corporate employees. Emotet<\/em> is mainly distributed via MalSpam email campaigns. This malware was discovered in 2014, and its main functionality was to steal bank credentials; that is, it started as a banking trojan; however, over time, it evolved into a powerful Botnet, used as Malware-as-a-Service (MaaS)<\/em>[1]<\/sub>, to be the gateway for other types of malware such as Ryuk<\/em>[2]<\/sub> ransomware[3]<\/sub>,<\/em> or other Trojans such as Trickbot<\/em>[4]<\/sub>, QakBot<\/em>[\/5]<\/sub> and Dridex<\/em>[6]<\/sub> or Cobalt Strike<\/em>[7]<\/sub> beacons.<\/p>\n

Based on various investigations, Emotet<\/em> is attributed to the threat actors known as MUMMY SPIDER[8]<\/sub> (also identified as TA542<\/em> or Mealybug<\/em>), making it one of the most dangerous and most frequently distributed threats \u201cIn-the-wild<\/em>[9]<\/sub>\u201d.<\/p>\n

Below is a timeline with an overview of Emotet’s<\/em> evolution.<\/p>\n

\"\"<\/p>\n

Figure 1 \u2013 Emotet timeline<\/p>\n

 <\/p>\n

The Sophisticated Emotet Botnet and Epoch Sub Botnets<\/strong><\/h1>\n

As we mentioned before, Emotet<\/em> evolved into a sophisticated Botnet<\/em>, which comprises sub-groups or sub-botnets, called \u201cEpoch.\u201d <\/em><\/strong>Each Epoch<\/em> has its C2 server infrastructure and distribution methods; this way of segmenting the Botnet can target different objectives with different payloads or act as redundant infrastructure[10]<\/sub>.<\/p>\n

As of this writing, five Emotet<\/em> sub-botnets are known, from Epoch 1<\/em><\/strong> to Epoch 5<\/em><\/strong>. In recent research[11]<\/sub>, Epoch 1<\/strong>, Epoch 2<\/strong> and Epoch 3 <\/strong>were observed before the Emotet<\/em> takedown in early 2021; Epoch 4<\/em><\/strong> and Epoch 5<\/em><\/strong> were introduced after its revival in late 2021.<\/p>\n

It is essential to mention that the Emotet<\/em> subgroup can generally be identified by the public encryption keys contained in the C2 configuration of the samples. Although each one of the Epoch’s Emotet<\/em> artifacts has its configuration data in different formats, they all store it in an encrypted “internal” DLL<\/em> embedded in the Emotet<\/em> executable payload.<\/p>\n

According to some research carried out[12]<\/sub>,<\/sub>[13]<\/sub>, the Epoch<\/em> 1, 2<\/em>, and 3 <\/em>sub-botnets can be identified because they use an embedded RSA (Rivest-Shamir-Adleman)[14]<\/sub> public key to encrypt the standard encryption key AES<\/em> (Advanced Encryption Standard)[15] <\/sub><\/em>which is used to encrypt network traffic.<\/p>\n

On the other hand, the most recent sub-botnets (Epoch 4 and Epoch 5)<\/em> use Elliptic Curve Cryptography (ECC)<\/em> to perform asymmetric encryption and make use of an embedded Elliptic Curve Diffie-Hellman (ECDH)[16]<\/sub> public-key identified as <\/em>ECK1<\/strong> and used for encryption, and an embedded Elliptic Curve Digital Signing Algorithm (ECDSA)<\/em>[17]<\/sub> public key identified as ECS1<\/em><\/strong> to perform data verification.<\/p>\n

The way the Emotet<\/em> Botnet is organized can make it difficult to track this threat, as research[18]<\/sub>,<\/sub>[19] <\/sub>has shown that bots that are part of Emotet<\/em> can be moved from one Epoch<\/em> to another, as well as being able to maintain the Botnet running in case an Epoch<\/em> is removed or is undergoing maintenance.<\/p>\n

Main features of Emotet<\/em><\/strong><\/h1>\n

As mentioned above, Emotet<\/em> is distributed via MalSpam<\/em> campaigns using Word or Excel documents, malicious links, password-protected .zip files, or, more recently, .lnk<\/em>[20]<\/sub> files for download.<\/p>\n

Phishing emails used to distribute Emotet<\/em> can be simple or contain images of trademarks or logos of well-known companies with related urgency messages such as pending invoices or payments, authorizations, etc.<\/p>\n

On the other hand, since the discovery of Emotet<\/em>, the use of different modules[21]<\/sub> has been identified, among which the following are mainly found<\/p>\n