Check Point Research: Emotet Trojan reappear
If you want to give a name to the malware, write a small biography, then the Emotet Trojan will be able to occupy a seat. The news has been there for many years: from the sizeable malspam infection bank in Germany in 2014 to the infection of the computer network in New Hampshire in July this year.
The initial goal of the tricky Emotet Trojan was bank vouchers, but it has recently discovered that Trojans have changed its strategy and goals, drawing the attention of researchers and law enforcement. Check Point Research mentioned in a report released on Tuesday:
“This includes deployment of endpoint, email and web-gateway protection technologies, as well as firewalls and vulnerability assessment solutions. Always keep these security solutions up-to-date with the latest protection capabilities.”
It turns out that these Trojans are useful in transmitting and can also successfully injure victims. In the official technical data of the US Department of Homeland Security, after Emotet infects national and local governments, the average cost of repairs per request is as high as $1 million.
Researchers at Symantec and Check Point said that the Emote Trojan has evolved new technologies and has become a communicator for distributing other threatening software and secretly blaming third-party open source code. Importantly, its core functionality has also changed. In 2017, the Trojan gave up its banking module and made it the most critical component. The move symbolises the expansion of its goals and the spread of threat strategies. Initially discovered by Trend Micro in 2014, the malware is now available as a downloader or distributor for other bank Trojan horses after acquiring devices through spam campaigns.
Emotet’s self-propagating ability is outstanding, so once it appears on the computer, it will download and execute an extension module. It has a list of passwords that are used to force access to other computers on the same network. Emotet can also be propagated to other computers through a spam module installed on an infected victim computer.
Malware currently uses five known extension modules: NetPass.exe (a legitimate utility that recovers all network passwords stored on the system), WebBrowserPassView (a password recovery tool that captures passwords stored by the browser, including the Internet) Explorer and Firefox Mozilla), Mail PassView (password recovery tool for various email clients, including Microsoft Outlook and Windows Mail), Outlook knife (a tool for removing names and email addresses from the victim’s Outlook account) and Credential enumerator.
This year, Symantec researchers discovered the link between Emotet and the dangerous organisation Mealybug, which has been active on the Internet since 2014. Mealybug seems to have expanded the capabilities and goals of Trojans and is what Symantec researchers call “end-to-end service for delivery of threats.”
“Mealybug’s shift from distributing its own banking trojan to a relatively small number of targets, to acting primarily as a global distributor of other groups’ threats, is interesting, and backs up an observation we made… that threat actors are evolving and refining their techniques and business model to maximize profits.”
For example, since February 2018, Emotet has been using its loader feature to spread the Quakbot family of malware, which behaves like a network worm. Also, malware is still distributing Ransom.UmbreCrypt ransomware.
Emotet has also enhanced its capabilities and strategies, including the use of third-party open source components. For example, malware builds a communication protocol on Google’s prototype, which uses Lempel-Ziv-Markov (LZMA) compression. LZMA is a chain algorithm for performing lossless data compression. Checkpoint researchers point out that “Easy access to third-party libraries is a powerful stimulant in any development process, and the design of the relevant design must have its benefits, and of course it is flawed. But who knows? Maybe we will see it in a few years. To enterprise-class malware written in Java, they call for more malware resources and cryptocurrency.
At the end of 2017, Emotet was found to spread the virus and spread the bank Trojan IDicID on the target system. In early July this year, officials in Portsmouth, New Hampshire, said that Emotet malware would cost $156,000 to remove after phishing emails were transmitted to the city’s entire computer network.
