Loading story…
EMOTET’s 64-bit variant was modified to calculate its configuration data, encryption keys, command-and-control (C2) endpoints, and strings dynamically at runtime instead of retaining readily recoverable encrypted blobs in the binary. The malware uses mixed Boolean-arithmetic obfuscation to conceal constants and decoding logic, reducing the effectiveness of static analysis and conventional signatures.
Elastic Security Labs developed an emulation-based extraction approach that uses YARA to identify decoding routines and cross-references, then Unicorn emulation to recover ECC public keys, C2 IP address-and-port pairs, and encoded strings. Defenders should account for runtime configuration recovery in EMOTET analysis and detection workflows, as static indicators may no longer expose its active infrastructure or configuration.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
EMOTET emerged as a modular banking trojan designed to harvest and exfiltrate bank-account information by inspecting network traffic.
Elastic Security released YARA rules to locate EMOTET key-decryption, C2-aggregation, and string-decoding routines used by its configuration-extraction workflow.
Elastic Security demonstrated an extraction workflow using YARA, cross-reference analysis, and Unicorn emulation to recover dynamically calculated ECC public keys, C2 IP-address-and-port pairs, and encoded strings from EMOTET.
EMOTET developers changed the malware's 64-bit variant to calculate configuration data, encryption keys, C2 addresses, and strings at runtime, rather than storing recoverable encrypted blobs in the binary.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and government analysts documented how **Emotet** hides its functionality through API hashing, dynamic API resolution, string encryption, junk code, stack tricks, and control-flow flattening, complicating reverse engineering of unpacked samples with empty import tables. Sophos reported that, across 254 examined functions, 68 used flattened control flow; researchers fully unflattened 38, partially restored 19, and failed on 11 while adapting IDA-based tooling to handle multiple dispatchers and other edge cases. Technical work from JPCERT/CC and open-source tooling showed that analysts can automate large parts of Emotet analysis with **Ghidra** and Binary Ninja plugins, including annotating hashed APIs, decrypting strings, and extracting hardcoded command-and-control endpoints from internal configuration data. ANSSI described Emotet as a **malware-as-a-service** platform operated by **TA542**, spread largely through phishing, malicious Office attachments, thread hijacking, compromised WordPress sites, and direct IP-based C2, and linked it to downstream payloads including **TrickBot**, **QakBot**, **Dridex**, **Conti**, and **Ryuk**.
Aug 15, 2026
Emotet continued to evolve from a banking trojan into a resilient modular malware platform, using phishing and thread-hijacked emails to deliver malicious Office files, password-protected ZIP archives, oversized documents, OneNote attachments, and later `.LNK` shortcut files. Multiple analyses showed operators repeatedly changing initial access and execution methods: older campaigns relied on VBA or XLM macros, while later waves used embedded VBScript, JavaScript, and shortcut-based loaders to fetch DLL payloads from hard-coded URLs and execute them with LOLBins such as `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `cmd.exe`, `PowerShell`, and `certutil.exe`. Researchers also documented a shift from earlier "Project X" payloads to a newer "Project Y" core DLL, alongside continued use of thread hijacking and downloader chains designed to blend into normal Windows activity. Technical reporting showed Emotet actively bypassing common defenses and maintaining a mature post-infection capability set. One Word-document sample used WMI so that `cmd.exe` was spawned by `WmiPrvSe.exe` instead of directly by Word, sidestepping Microsoft Defender's Office child-process Attack Surface Reduction rule; another macro deobfuscated strings, launched WMI-backed process creation, and ran a base64-encoded PowerShell downloader. Across samples, the malware established persistence through Registry Run keys or Windows services depending on privilege level, used process hollowing, browser credential theft modules, encrypted command-and-control with embedded RSA/AES or ECC-based protections, and rotated hard-coded C2 infrastructure. Defenders were advised to block password-protected archives and macro-enabled documents where possible, hunt for WMI-originated process creation, and monitor for suspicious use of `regsvr32.exe`, `rundll32.exe`, and other LOLBins tied to Emotet delivery chains.
Aug 15, 2026
**Emotet** developed from a banking trojan targeting German, Austrian, and later Swiss banks into a modular malware platform used for credential theft, spam propagation, and follow-on intrusion activity. Early and mid-stage variants were commonly delivered through phishing emails, malicious links, macro-enabled Office files, or JavaScript downloaders, then established persistence, injected into processes, harvested host and email data, and communicated with hard-coded or encrypted command-and-control infrastructure using protected configurations and encrypted traffic. Researchers documented repeated anti-analysis upgrades, including debugger and sandbox checks, abuse of the Windows `CreateTimerQueueTimer` API, fake or obfuscated C2 data, and repeated self-updates designed to frustrate reverse engineering. Later Emotet campaigns added stronger camouflage on both the wire and in the binary, with more RFC-compliant HTTP traffic, randomized URIs, and a redesigned configuration scheme that split obfuscated C2 addresses across multiple functions instead of storing a single encrypted blob. Incident responders also observed Emotet acting as an **initial access broker**: in one enterprise intrusion, a phishing-delivered Excel file installed Emotet, which spread via email, then downloaded **Cobalt Strike** and enabled credential dumping, Kerberoasting, lateral movement, remote-access tool deployment, and data exfiltration with **Rclone** to **MEGA**, stopping only before likely ransomware deployment. The reporting shows Emotet’s progression from banking malware into a resilient access-and-delivery ecosystem that supports broader post-compromise operations, including combinations with threats such as **Trickbot** and **Ryuk**.
Aug 15, 2026