A core function of the new package is that instead of bundling the Emotet loader with the spreader, the loader is now downloaded from a server. Previously a stand-alone program, the new Wi-Fi spreader has become a full-fledged module in the Emotet package. While not affecting the functionality of the malware, the changes allow for step-by-step logging and debugging logs from the infected machines. Using a new communications protocol, two PHP POST arguments are sent to provide the aforementioned debugging output. The only notable change to Emotet’s spreader functionality is should the brute-force against the C$ share fail, the spreader attempts to brute-force the ADMIN$ share. As with previous versions of Emotet, services.exe is downloaded from a hard-coded server. This version of services.exe downloads the Emotet binary from the C2. If Emotet is downloaded successfully, services.exe sends “payload downloaded ok” to the C2 before execution.
Block all threat indicators at your respective controls.