Emotet is a banking trojan usually distributed via email spam. The malicious word documents are now increasingly delivered within a password-protected zip-file. This is done in order to prevent researchers to automatically detect and extract Emotet’s IoCs. Until recently, Emotet was rarely distributed with a password protected archive. Most spams featured a link to an office document or had it attached directly to the email. There have been just a few zip-file occurrences at the beginning of September. Recently, significant volume of emails containing zips with Emotet have been reported. Emotet is currently using random first names to create authentic reply chains, with an empty “Original Message” footer. The first lines of the email will now reference an encrypted zip file archive and provide the password, instead of just mentioning the document as before. Emails have been spotted in several different languages just like before.