Rewterz Threat Alert – Multiple Phishing Campaigns Dropping Emotet Malware and Stealing Information

Severity: Medium

Analysis Summary

MalSpam Phishing campaigns have been observed targeting financial organizations to drop malware. The campaigns include:

Emotet Phishing: This campaign drops the emotet malware which is capable of network-wide infection and has advanced features to evade detection.

AMEX themed Phishing This campaign has been going on for a while and resurfaces with new variants every now and then. This phishing email contains an HTML attachment which loads a script from a remote site. Decoding this JavaScript, a phishing form appears requesting the recipients to enter sensitive information like their online account credentials, card number, security code, expiration date, mother’s maiden name, mother’s birth date, birth year, first elementary school name, their security pin, etc.

Impact

• Network-wide Infection
• Account compromise

Indicators of Compromise

URLs

https[:]//emiuk[.]org/

Filename

myvtfile.exe

Email Subject

New invoice from Himanshu Khurana

Invoice Attached for Payment

Malware Hash (MD5/SHA1/SH256)

• f149fcb5b0f7ef28a235cb81d7ee4dbc
• 3acb33d68f5b39c3f8c083ae81bcba9ab3cfe73d
• cacca9f46b8a5fc85187b7adee630979
• 1d437f1bca057040515ca5aeecb2539c15a99c01
• 7c344293212b1de4798beb0cf70c9bec493460d5befba2eef1ce26a83c04ad2f

Remediation

• Block threat indicators at their respective controls.
• Spread phishing awareness among end users.
• Do not download email attachments coming from unknown sources.
• Never enter sensitive information on any site unless intended, and always type the legitimate URL instead of following links