Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader

Threats & Defenses

As featured in the 2018 State of Cybercrime Report released this week by Secureworks®, a small list of cybercrime malware is making the greatest impact in today’s threat landscape, including — but not exclusively limited to — malware families like Emotet.

Emotet is a modular downloader, deployed by financially motivated criminals to steal credentials, collect email addresses for use in spam campaigns, use a compromised host as a proxy or spam server, and install other payloads on the networks of unsuspecting organizations.

One of the most dangerous capabilities that any downloader malware can have is the ability to propagate automatically to infect additional hosts within a network. If it can do that, it can increase the number of computers that have payloads delivered to them, causing victims greater disruption, higher cost, and increased difficulty in containing infections.

In mid-2018, analysis by Secureworks Counter Threat Unit® (CTU®) researchers of one particular Emotet module explained how the malware was able to spread rapidly in some networks, but barely at all in others. The secret, it turned out, was a hardcoded list of passwords.

Is Your Password on this List?

Using this module, Emotet would attempt to spread automatically to other systems using Microsoft’s Server Message Block (SMB) protocol. When challenged for a password it would attempt to guess the correct answer by iterating through a list of common passwords hardcoded into the module. The list, provided below for your reading pleasure, included basic numerical combinations (‘123456789’), common names (‘andrew’), popular cultural figures (‘spiderman’), sports teams (‘steelers’), and some colloquial terms that are far less acceptable in print… For those readers who are offended by inappropriate language: you have been warned!

The malware only had to guess correctly once in order to infect the new computer, install itself as a service for persistence and attempt to spread to additional computers from there. The difference for organizations between having a password policy that forced users to have difficult- to- guess passwords versus having a weak password policy or no password policy at all was, in the case of Emotet, measured in terms of hundreds of infected computers, dozens of hours of incident response and tens or even hundreds of thousands of dollars.

Proper credential management is a key recommendation that Secureworks incident responders find themselves often making in the aftermath of a breach. The experience of dealing with Emotet shows that it will be time well spent. We always recommend that clients adopt a policy that forces users to create passwords that they can remember, but that are hard to guess. (Combinations of words might work better for your employees than randomized 15 character alpha-numeric strings with special characters.) It’s also important to use technical controls and user education to reduce the potential for password re-use, and to remind users that using their first name or their preferred swear word is probably making things a little too easy for the criminal. (Table 1 is case in point!)

*TABLE 1 – Emotet Password List

This list contains some passwords using explicit language, and those items have been redacted because they may be offensive to some readers. If you would like to check whether your password is on the actual list, you may access the unredacted list here.

0000

alison

cool

hobbes

naughty

shannon

00000

allison

cooper

hockey

ncc1701

sharon

000000

alpha

copper

homer

ncc1701d

shelby

00000000

alyssa

corvette

honda

nelson

shit

007007

amanda

cougar

hooters

nemesis

shithead

01011980

america

courtney

horney

newport

shorty

01012011

american

cowboy

horny

newyork

Sierra

010203

anderson

cowboys

horses

nicholas

Silver

098765

andre

crazy

hotdog

nicole

Simon

0987654321

andrea

creative

hotrod

nigger

Simple

101010

andrew

cricket

house

nikita

Simpson

102030

andrey

crystal

houston

nintendo

Simpsons

1111

angel

cumshot

howard

nirvana

Skipper

11111

angela

cunt

hummer

nissan

Skippy

111111

angels

daddy

hunter

norman

Skyline

1111111

animal

dakota

iceman

nothing

Slayer

11111111

anthony

dallas

iloveyou

november

Slipknot

1111111111

antonio

dancer

indian

october

Slut

111222

apollo

danger

infinity

oksana

Smith

112233

apple

daniel

internet

oliver

Smokey

11223344

apples

danielle

ireland

olivia

Smooth

1212

arizona

darkness

ironman

online

Snickers

121212

arnold

darkside

iwantu

orange

Sniper

12121212

arsenal

dave

jack

ou812

Snoopy

12312

arthur

david

jackass

packers

Snowball

123123

asd123

death

jackie

pakistan

Soccer

123123123

asdasd

debbie

jackson

pamela

Softball

123123a

asdf

december

jaguar

pantera

Sophie

1232323q

asdf1234

denise

jake

panther

Spanky

123321

asdfasdf

dennis

james

panthers

Sparky

1234

asdfg

denver

jasmine

panties

Speedy

12341234

asdfgh

destiny

jason

paradise

Spencer

12344321

asdfghjk

dexter

jasper

parker

Spider

12345

asdfghjkl

diablo

jeffrey

pass

Spiderma

1234554321

ashley

diamond

jennifer

passion

Spiderman

123456

asshole

dick

jeremy

passport

Spirit

1234567

assman

dickhead

jessica

passw0rd

Spitfire

12345678

august

diesel

jessie

password

Spooky

123456789

austin

digger

jester

password1

Spring

1234567890

avalon

digital

jesus

patches

Stalker

123456789a

avatar

disney

jimmy

patricia

Stanley

123456789q

awesome

doctor

john

patrick

Star

123456a

azerty

doggie

johnny

patriots

Stargate

123456q

baby

dolphin

johnson

paul

Startrek

12345a

babygirl

dolphins

jonathan

peaches

Starwars

12345q

badass

domino

jordan

peanut

Steelers

12345qwert

badboy

donald

jordan23

pearljam

Stella

1234qwer

badger

donkey

joseph

peekaboo

stephen

123654

bailey

douglas

joshua

penguin

steve

123654789

bambam

dragon

junior

penis

steven

123789

banana

dreamer

jupiter

people

stinky

123abc

bandit

dreams

justice

pepper

stupid

123qwe

barbara

driver

justin

peter

sublime

12qwaszx

barney

drowssap

juventus

phantom

success

1313

baseball

drummer

karina

phoenix

sucker

131313

bastard

ducati

kawasaki

phpbb

suckit

134679

batman

duncan

kelly

picard

suckme

141414

baxter

eagle

kermit

pimpin

summer

147147

bear

eagle1

kevin

pirate

sunshine

147258

beatles

eagles

killer

platinum

super

147258369

beaver

eclipse

kimberly

playboy

superman

147852

beavis

edward

king

player

surfer

147852369

beer

einstein

kirill

please

suzuki

151515

benjamin

electric

kitten

pokemon

svetlana

159357

bigboy

elephant

kitty

police

sweet

159753

bigcock

elizabet

klaster

polina

swordfis

159951

bigdaddy

elvis

knight

poohbear

sydney

1966

bigdick

eminem

kristina

pookie

system

1969

bigdog

empire

lacrosse

poop

taylor

1974

bigred

england

lakers

poopoo

tennis

1975

bigtits

enigma

lalala

popcorn

teresa

1977

bill

enter

lasvegas

porn

test

1978

billy

eric

lauren

porno

test123

1979

birdie

eugene

legend

porsche

tester

1980

bishop

everton

leslie

power

testing

1981

bitch

explorer

letmein

predator

theman

1982

bitches

extreme

liberty

prince

therock

1984

biteme

falcon

lifehack

princess

Thomas

1985

black

family

little

private

Thumper

1986

blazer

fantasy

liverpoo

psycho

Thunder

1987

blink182

fender

liverpool

pumpkin

thx1138

1988

blowjob

ferrari

lizard

purple

Tiffany

1989

blowme

fire

logitech

pussy

Tiger

1990

blue

fireman

lol123

q1w2e3

Tigers

1991

bobby

fish

london

q1w2e3r4

Tigger

1992

bollocks

fishing

louise

q1w2e3r4t5

Timothy

1993

bond007

fktrcfylh

love

qazwsx

Tinker

1994

bonnie

florida

lovelove

qazwsxedc

Titanic

1q2w3e

boobies

flower

lovely

qazxsw

Tits

1q2w3e4r

booboo

fluffy

loveme

qqq111

Tomcat

1q2w3e4r5t

boobs

flyers

lover

qqqqqq

Tommy

1qaz2wsx

booger

football

loverboy

qwaszx

Topgun

1qazxsw2

boogie

ford

lovers

qwe123

Toyota

2000

boomer

forest

loveyou

qweasd

travis

202020

boston

forever

lucky

qweasdzxc

trinity

2112

bradley

francis

lucky1

qweqwe

trouble

212121

brandon

frank

maddog

qwer1234

trustno1

2222

brandy

frankie

madison

qwert

tucker

222222

braves

franklin

madmax

qwerty

turkey

232323

brazil

fred

madonna

qwerty1

turtle

242424

brenda

freddy

maggie

qwerty12

tweety

252525

brian

free

magic

qwerty123

united

315475

brittany

freedom

magnum

qwertyu

Usuckballz1

3333

bronco

freepass

manutd

qwertyui

valentin

333333

broncos

freeuser

marcus

qwertyuiop

vampire

420420

brooke

friday

marina

rabbit

vanessa

4321

brooklyn

friend

marine

rachel

vegeta

4444

brutus

friends

marines

racing

veronica

444444

bubba

froggy

mark

raider

vfhbyf

456789

bubbles

fuck

marlboro

raiders

vfrcbv

4815162342

buddha

fucker

marley

rainbow

victor

5150

buddy

fucking

marshall

ranger

victoria

54321

budlight

fuckme

martin

rangers

victory

5555

buffalo

fuckoff

marvin

raptor

viking

55555

bulldog

fuckyou

maryjane

rascal

vikings

555555

bulldogs

fylhtq

master

rasdzv3

vincent

55555555

bullet

gabriel

matrix

razz

viper

654321

bullshit

galina

matt

rebecca

virginia

6666

burton

galore

matthew

red123

vision

666666

buster

gandalf

maverick

reddog

vladimir

6969

butter

garfield

maximus

redrum

voodoo

696969

butthead

gateway

maxwell

redskins

Voyager

69696969

calvin

gators

melanie

redsox

Walker

741852963

camaro

gemini

melissa

redwings

Walter

7654321

cameron

general

member

reggie

Wanker

7777

canada

genesis

mercedes

richard

Warcraft

777777

captain

genius

mercury

robert

Warrior

7777777

cardinal

george

merlin

rock

Water

77777777

carlos

georgia

metallic

rocket

Welcome

789456

carmen

gfhjkm

metallica

rocky

Westside

789456123

carolina

ghbdtn

mexico

roland

Whatever

852456

caroline

giants

michael

rolltide

Wildcat

8675309

carter

gibson

michael1

rooster

Wildcats

87654321

cartman

ginger

michelle

rosebud

William

8888

casper

girls

michigan

runner

Williams

888888

cassie

goblue

mickey

rush2112

Willie

88888888

celtic

godzilla

midnight

ruslan

Willow

9379992

champion

golden

mike

russell

Wilson

987654

chance

golf

miller

russia

Windows

98765432

changeme

golfer

mine

sabrina

Winner

987654321

charles

goober

minecraft

saints

Winston

9999

charlie

google

mitchell

samantha

Winter

999999

cheese

gordon

mmmmmm

sammy

Wizard

a12345

chelsea

green

mnbvcxz

samson

Wolf

a123456

cherokee

gregory

molly

samsung

Wolfpack

a1b2c3

cherry

guinness

monday

samuel

Wolverine

aaaa

chester

guitar

money

sandman

Wombat

aaaaaa

chevelle

gunner

money1

sandra

Xavier

aaaaaaaa

chevy

hahaha

monica

sarah

Xxxx

abc123

chicago

hammer

monkey

saturn

Xxxxxx

abcd1234

chicken

hannah

monster

scarface

Xxxxxxxx

abcdef

chopper

happy

montana

school

Yamaha

abcdefg

chris

happy1

mookie

scooby

Yankee

access

christ

hard

morgan

scooter

Yankees

accord

christin

hardcore

mother

scorpio

Yellow

action

claire

harley

motorola

scorpion

Yfnfif

adidas

classic

hawaii

mountain

scotland

Zachary

adrian

claudia

heather

mozart

scott

zaq12wsx

airborne

cocacola

heaven

muffin

scotty

Zombie

alaska

cock

hello

murphy

secret

zxc123

albert

coffee

hello1

music

security

Zxcvbn

alex

college

hello123

mustang

semperfi

Zxcvbnm

alexande

colorado

helpme

naruto

serega

Zzzzzz

alexander

compaq

hendrix

nascar

sergey

alexandr

computer

hentai

natalie

sexsex

alexis

connor

hiphop

natasha

sexy

alicia

cookie

hitman

nathan

shadow

Products You May Like

Articles You May Like

Bargain or Bogus Booking? Learn How to Securely Plan Summer Travel
Cyberattack exposes travelers’ photos, says US border agency
After Equifax breach, US watchdog says agencies aren’t properly verifying identities
Microsoft warns of time-travelling equation exploit – are you safe?
Android’s Built-in Security Key Now Works With iOS Devices For Secure Login

Leave a Reply

Your email address will not be published. Required fields are marked *