Loading malware…
Emotet is a malware family first identified in 2014 that began as a banking Trojan focused on financial data theft and later evolved into a modular malware loader/downloader. The content describes it as a multifaceted and, in some reporting, polymorphic threat that commonly delivers additional malware such as TrickBot, as well as other payload categories including ransomware, information stealers, and cryptocurrency miners. It is associated with TA542, also referred to as Mummy Spider in the provided material.
The primary infection vector described is phishing and spearphishing. Emotet campaigns rely on users opening malicious attachments or links, with lures themed around invoices, payments, shipping, and other business communications. Delivery methods mentioned include Microsoft Word and Excel documents containing VBA or XL4 macros, XLL files, zipped LNK attachments, ISO files, and HTML smuggling after macro-based delivery became less effective. One analyzed document used obfuscated VBA with an AutoOpen routine and document properties to construct and execute a command, followed by a PowerShell downloader that iterated through multiple URLs, wrote an executable with a random filename into %TEMP%, and launched it. The content also explicitly notes Emotet use of Base64-encoded PowerShell commands to download and execute additional payloads.
Operationally, Emotet is described as modular and staged. It can infect a machine and then download follow-on malware. Symantec’s analysis of a Version 5 (20200201) variant states that Emotet operates in two stages: a first-stage dropper instance and a second-stage bot instance. The malware uses anti-analysis and obfuscation techniques including control flow flattening, runtime decryption of strings and resources, and dynamic API resolution via hashed DLL and API names. It generates synchronization objects from the Windows volume serial number, attempts to remove older variant binaries, and drops itself either into the system directory or Local AppData depending on privilege level.
Persistence mechanisms directly mentioned include creating a new Windows service when running with elevated privileges, creating a Run key under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run when running with lower privileges, and creating new services more generally. The content also states Emotet has been observed creating new services to maintain persistence.
For command and control, the content states Emotet has used HTTP. Symantec’s analysis adds that the malware stores embedded C2 IP/port pairs in the binary and secures communications using an embedded RSA public key together with AES-128-CBC and SHA-1. The analyzed variant sent encrypted traffic via HTTP POST using multipart/form-data with randomized URI subpaths, boundaries, form names, and filenames. The same analysis states Emotet replaced prior zlib-based compression with a customized LibLZF implementation.
Capabilities explicitly described include downloading and executing binaries, launching payloads in another active Terminal Services session, and downloading and executing plugin modules. The broader content also ties Emotet infections to post-compromise activity and follow-on tooling: one intrusion began with Emotet, then involved eight days of attacker activity including enumeration, lateral movement with Cobalt Strike, remote access via Tactical RMM and AnyDesk, data exfiltration with Rclone, and eventual deployment of Quantum ransomware.
Campaign and ecosystem context in the content links Emotet to TA542/Mummy Spider and notes that SilentBuilder is a campaign used to launch banking malware such as Emotet and grow the Epoch5 botnet. SilentBuilder infection chains described in the content used spearphishing emails with XLS or DOCX attachments containing macros or hidden functions that downloaded a DLL and executed it via Regsvr32.exe, after which the DLL attempted to contact multiple C2 servers. Emotet is also referenced as a common initial-access or paired malware family in broader criminal ecosystems, including alongside loaders such as Buer and QBot and in contexts where SystemBC is deployed later.
High-confidence indicators and artifacts directly mentioned in the content include the lure URL hxxp://bengalcore.com/Invoice-26396-reminder/; PowerShell downloader URLs focalaudiodesign.com/hl/, furstens.se/sdxCegqHa/, firstreport.com/vsIFKF/, sarahbradley.com/WVfJHSF/, and belongings.com/lQelF/; intrusion-related URLs hxxp://blockchainjoblist[.]com/wp-admin/014080/, hxxps://womenempowermentpakistan[.]com/wp-admin/paba5q52/, hxxps://atnimanvilla[.]com/wp-content/073735/, hxxps://yeuquynhnhai[.]com/upload/41830/, and hxxps://deepikarai[.]com/js/4bzs6/; and a sample hash aa0cbe599839db940f6cc2f4ca1383dbb9937b8c7dd6460847c983523cd63c39 for the analyzed Version 5 variant.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Emotet has been known to move from machine to machine by leveraging a server message block (SMB) vulnerability exploit like ETERNALBLUE or by brute-forcing credentials for access to Windows Administrative Shares.
In late 2023, Microsoft and the U.S. National Institute of Standards and Technology (NIST) reported that attackers were using a Windows vulnerability to distribute malware, including Emotet... The technique involved phishing emails with malicious attachments that leveraged a Windows feature known as the App Installer... To reduce the risk of exploitation, Microsoft updated the software to disable the affected functionality by default.
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
According to SocRadar, the group exploits zero-day vulnerabilities to bypass security defenses and has deployed malware including GrandCrab and Emotet.
SilentBuilder is a campaign that is being used to launch bankers such as Emotet to increase the Epoch5 botnet...
Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.
The versatile and disruptive malware Emotet previously served as one of the most prolific distributors of malware enabling costly ransomware infections between 2018 and 2020.
Le 11 mars 2022, le compte Twitter @Cryptolaemus1 a identifié la distribution d’un implant SystemBC par le botnet Epoch 5 lié au Malware-as-a-Service (MaaS) Emotet.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
According to SocRadar, the group exploits zero-day vulnerabilities to bypass security defenses and has deployed malware including GrandCrab and Emotet.
Emotet primarily spreads through phishing emails. These emails often appear legitimate, containing familiar branding and enticing subjects like invoices, payment details, or shipping notifications.
it contains interesting functions that will run automatically when opened
This write-up explores how attackers use variations of the encoded command switch in PowerShell... such as -e, -en, -enc, -enco. | PowerShell’s encoded command switch allows users to run scripts encoded in Base64 format... The attacker can encode any script and run it using these switches, effectively hiding the command’s intent from plain view.
the document will contain macros or hidden functions, it will download a file, usually a dll
The intrusion began when a user open a malicious document received through an email and enabled the content.
Calls API WTSQueryUserToken to obtain the Primary User token of the requested Terminal Service session - Calls API CreateProcessAsUser to launch process
we found all the functions obfuscated and disordered. In one of the sheets, we find the most important function, which would deobfuscate most of the functionality
MITRE ATT&CK Mapping | Defense Evasion | T1027.006 | HTML smuggling, payload assembled client-side
This sample will scan in CSIDL_SYSTEM, only filenames with the extensions .dll and .exe are selected... Emotet then makes a path to drop itself to... The path of the dropped file is: “(CSIDL_SYSTEMX86|CSIDL_LOCAL_APPDATA)\\%s\\%s.exe”
Calls API WTSQueryUserToken to obtain the Primary User token of the requested Terminal Service session - Calls API CreateProcessAsUser to launch process
Emotet enumerates running process names (no duplicated process names, no process names where parent process ID is 0, and not including Emotet’s process name) puts them in buffer, separated by comma, and in ASCII.
The plaintext packet has the following format ... victim_id ... system_info ... procname_buffer ... module_id_array ... Emotet is generating VICTIM_ID based on computer name and volume serial number ... calculating system info value based on OS version, product type, and processor architecture.
288 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as malware deployed by the Unsafe ransomware group during intrusions.
Emotet1
Loader used to gain initial access before SystemBC deployment.
Referenced as malware that adopted HTML smuggling as an alternative delivery technique when macro-based delivery became less effective.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.