Emotet is back and targeting different users around the world with the phishing campaign. The malicious emails are being sent by 3,362 different senders, whose credentials had been stolen. The count for the total number of unique domains reached 1,875, covering a little over 400 TLDs.
When the Emotet botnet came back to life again, it was using a malicious Word document template that asked you to “Accept the license agreement” by clicking on the “Enable Content” button. Doing so, would enable macros embedded in the document that would then install the Emotet Trojan on the recipient’s computer.
Emotet has changed its malicious document template to use a new “Protected View” lure. This lure tells the potential victims that the “action can’t be completed because the file is open in Protected View. Some active content has been disabled. Click Enable Editing and Enable Content.”
Malware Hash (MD5/SHA1/SH256)