Rewterz Threat Alert – Emotet Distribution in Password-Protected Zip-Files

Severity

High

Analysis Summary

Emotet is a banking trojan usually distributed via email spam. The malicious word documents are now increasingly delivered within a password-protected zip-file. This is done in order to prevent researchers to automatically detect and extract Emotet’s IoCs. Until recently, Emotet was rarely distributed with a password protected archive. Most spams featured a link to an office document or had it attached directly to the email. There have been just a few zip-file occurrences at the beginning of September. Recently, significant volume of emails containing zips with Emotet have been reported. Emotet is currently using random first names to create authentic reply chains, with an empty “Original Message” footer. The first lines of the email will now reference an encrypted zip file archive and provide the password, instead of just mentioning the document as before. Emails have been spotted in several different languages just like before.

Impact

• Theft of sensitive information
• Financial loss

Indicators of Compromise

MD5

• 4473e1406415a70312e54713b3ee5461
• 8ab198ee39b8dceebf833581222d4a2e
• db928ce2ca31b422d4e5785932fc8f22

SHA-256

• 003f19a4d9c1af6c87b437385d5274bb39fc4499264dbde7dcf76f5db1f351fa
• 2f345073e3bb0169d18ee8fe2dc052679777afa5f862fe6dc895688a8c4958d0
• 67824f7d30de00f42e6113fd77722452ace44733dddd60a0fba1c54567aefa1f

SHA1

• 187d38f6674c38a4c968fc3ea25ccce89f111f59
• a9f495d3b70870b023fc723cfb0afbd56cd7b75d
• 688b349c1f623c7d10a6a3f9141bffedbd6d519e

Source IP

• 71[.]72[.]196[.]159
• 190[.]192[.]39[.]136

URL

• http[:]//personalizzabili[.]com/images/lvyX7QK/
• http[:]//sasystemsuk[.]com/index_files/j9b/
• http[:]//bigtreestudios[.]org/temporary/cpmNZIXomC/

Remediation

• Block the threat indicators at their respective controls.
• Do not download unexpected password-protected zip-files coming from unknown sources.