March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – ICS: Johnson Controls American Dynamics VideoEdge
December 23, 2021
Rewterz Threat Alert – Dridex Banking Malware Installed using Log4j – Active IOCs
December 23, 2021
Rewterz Threat Advisory – ICS: Johnson Controls American Dynamics VideoEdge
December 23, 2021
Rewterz Threat Alert – Dridex Banking Malware Installed using Log4j – Active IOCs
December 23, 2021
Severity
High
Analysis Summary
Emotet has recently found in increased cyber activities after a short period of dormancy. Fresher IoCs are being retrieved everyday. Emotet is a banking trojan turned to a malware loader that drops other payloads after initial infection, often Qbot. Emotet Malware is constantly being detected in the wild, targeting organizations from multiple sectors and countries, primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet operators usually try to get users to click the malicious files by using lures like “YourInvoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. Emotet has gone through a few iterations. Early versions arrived as a malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers. Lately, Emotet infections have been used to distribute other malware like Qakbot. So these can be multi-stage attacks that bundle other malware with emotet.
Impact
- Credential Theft
- Information Theft
- Financial Loss
Indicators of Compromise
Filename
- Voeyhlcnfx[.]dll
MD5
- 3537ad7979bdcd294c534ed3fa174b34
- 7824867cd4bea82736bbb37e5c238af6
- bd474353e5301d788a747d9b80fbad7a
- 99a1b9099a5e12108c11083c347e9547
SHA-256
- 1b65600b49360f09e49fc647946e0155c9c033d8fdd5d3f5b5ba6a0df9ddcafa
- 1357816a7fc1f42f32d31d5f44a9f87ca42e9ac40e759cd970f386661fc7062f
- 9b8145d9128a594922b1c5a39e350b642e72e791781bfd4b399f30d4be2e9f73
- ea0228af231ede5ca6639c1826a5c73906d6570c2e8b0f0054efd5eb39711513
SHA-1
- 81fc323066208c9ef00b09016495c668a33b0e95
- 67a026b8f6f84797d020653d293940e429498a3f
- 0db63d4ad546a44b11c43d160264ab12cf13479d
- 883c093f24c307b0d5b3b570d768ded0dc87f507
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.