Loading malware…
Emotet, also known as Geodo and Heodo, is a modular Windows malware loader and botnet first observed in 2014 as a banking credential stealer. It evolved into a criminal malware-distribution service that provides access to compromised computers and delivers additional payloads. It affects individuals and organizations worldwide rather than exclusively targeting a particular industry. Emotet has distributed TrickBot and QakBot and has enabled attack chains leading to ransomware, including Ryuk, Conti, and DoppelPaymer.
Emotet commonly spreads through malicious spam and phishing emails containing links or attachments. Infection chains have used Microsoft Word and Excel documents with macros that launch PowerShell to download and execute the malware. Campaigns have also used malicious Windows shortcuts and password-protected archives. Its email-theft and spam modules collect correspondence and contacts and use compromised email accounts to distribute further malicious messages.
Its downloadable modules support browser and email credential theft, process enumeration, and collection and exfiltration of Outlook and Thunderbird messages and address information. Emotet has also deployed password-grabbing tools, including Mimikatz. It establishes persistence through Windows services or user-level autostart configuration, injects code into legitimate processes, and uses obfuscation and polymorphic variation to hinder detection. Network-propagation capabilities include password guessing against user accounts and lateral movement through SMB exploitation.
Analyzed versions protect command-and-control communications with AES keys derived through ECDH and verify downloaded payloads with ECDSA. Modules can execute within an existing process or be written to disk and launched separately. Additional functionality tests external connectivity and attempts to configure router port forwarding through UPnP. An international law-enforcement operation disrupted Emotet in January 2021, but it returned in November 2021 through TrickBot delivery and subsequently resumed its own spam campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The flaw is designated as CVE-2020-9054. Holden said the exploit is now being used by a group seeking to fold it into Emotet, while Zyxel has released patches for some affected products.
InvisiMole can spread within a network via EternalBlue (CVE-2017-0144). Emotet, Lucifer, NotPetya, PoshC2, TrickBot, Tonto Team, and Wizard Spider are also explicitly linked to EternalBlue; Threat Group-3390 exploited MS17-010. | Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.
In Microsoft’s December 14, 2021, Patch Tuesday vulnerability release, security patches were released for a high severity zero-day vulnerability impacting the Windows AppX installer. The vulnerability is tracked as CVE-2021-43890 (CVSS: 7.1). Exploitation allows a threat actor to create a malicious file that appears to be a legitimate application. Exploitation in the wild has been observed in the delivery of multiple malware types including: Emotet, Trickbot, and BazarLoader. | Exploitation in the wild has been observed in the delivery of multiple malware types including: Emotet, Trickbot, and BazarLoader.
Emotet has previously exploited CVE-2017-11882, a remote code execution flaw in the Microsoft Equation Editor. Detection network connections from eqnedt32.exe can be an indicator of exploit. | Kroll has been tracking Emotet since it was first identified in 2014, especially during its transition from a banking Trojan designed to primarily steal credentials and sensitive information to a multi-threat polymorphic downloader for more destructive malware.
26 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Emotet has been delivered by phishing emails containing attachments.
In 2019, a relationship between Emotet, TrickBot, and Ryuk ransomware was discovered, where the Ryuk ransomware operators were granted access to an organization through a TrickBot infection.
In Dec 2019, the company’s researchers captured multiple conversations in hackers’ communities discussing the launch of EMOTET campaigns.
In Dec 2019, the company’s researchers captured multiple conversations in hackers’ communities discussing the launch of EMOTET campaigns.
In Dec 2019, the company’s researchers captured multiple conversations in hackers’ communities discussing the launch of EMOTET campaigns.
The Emotet botnet is back by popular demand, resurrected by its former operator, who was convinced by members of the Conti ransomware gang.
48 distinct techniques documented for this family, organized by ATT&CK tactic.
3,151 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as an example of malware that malicious tax-themed attachments could install. The article describes email and contact theft and facilitation of ransomware or financial fraud, but does not confirm Emotet was present in the specific scam shown.
Spreads through phishing and installs secondary payloads, including QakBot and TrickBot, enabling subsequent ransomware attacks. The article describes repeated disruption, rebuilding, and intermittent activity after its January 2021 takedown.
Concealed its controllers behind multiple proxy tiers spanning compromised web servers and home computers. An international operation seized its infrastructure in January 2021, but it returned later that year.
Botnet malware that propagated through forged and malicious email campaigns. It stole email inboxes, contact lists, and SMTP credentials from victims, abused trusted relationships, and later replied to existing email threads to distribute malware-laden messages.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.