Emotet Malware  - Emotet Malware - Hackers Delivering Emotet Malware Via Microsoft Office Documents

A new malware campaign that delivers Emotet Malware Via Microsoft Office documents attachments with “Greeting Card” as the document name.

targeted the USA’s Independence Day to trick users into downloading the malicious document and to install the malware.

The Banking Trojan EMOTET was identified in 14, it has the capabilities of stealing personal information such as username and Passwords.

Emotet Malware Campaign

The new malware campaign was spotted by Zscaler’s research team and it is active between July 2nd to July 4th, “We saw over two dozen unique payloads hitting our Cloud Sandbox in the 48-hour span.” said Zscaler.

The document contains a tricky social-engineered message that asks users to enable content that allows the malicious macro to run in the background. The Macro obfuscated to avoid detection’s and it triggers wscript.exe to run the command.

Emotet Malware  - enable editing 0 - Hackers Delivering Emotet Malware Via Microsoft Office Documents

Wscript downloads the payload through PowerShell script, finally, the De-obfuscated PowerShell command parameters the Emotet payload and drops in the temp directory.

Emotet is a widely distributed malware it is commonly distributed via malicious spam campaigns that contain office documents, every time it emerges with new capabilities.

It is a multi-component malware that is capable of stealing credentials through browsers and email, Man-in-the-Browser attack and email harvesting.

With the last campaign, it includes a future called RunPE, that hides malware into the Legitimate process to evade the scanners and inject its code into windows executable process.

Also

Important Security practices for users to Open Microsoft Office Documents Securely

EMOTET Malware Hijacking the Windows API & Evade the Sandbox Analysis

Banking Trojan Called “EMOTET” Re-emerging to Steal Username And Password



Source link

No tags for this post.

LEAVE A REPLY

Please enter your comment!
Please enter your name here