Black Friday special by Emotet: Filling inboxes with infected XML macros

ESET has detected another large Emotet campaign, probably connected with the increased online shopping and email correspondence around Black Friday. Compared to the previous attacks, the operators have slightly modified their modus operandi. Emotet is still being distributed via spam emails containing attachments with malicious macros or links to such files. Around Black Friday, however, the attachments and links have been serving XML files with .doc extension instead of the previously observed DOC and PDF files.

As to the secondary payloads, Emotet is currently distributing various banking malware families, including Ursnif, TrickBot and most frequently IcedId. The latter also downloads another payload, Azorult (ESET detects this malware as Win32/PSW.Delf.OSF), known for its ability to steal passwords, credit card details and access to cryptocurrency wallets. TrickBot, on the other hand, has upped its game by adding multiple UK and German banks to the list of its targets. This corresponds with German and English subject lines of the spam emails and their contents that ESET described in its latest blog about Emotet.

Looking at the geographical distribution, Latin American (LATAM) countries seem to be amongst the most affected – with Mexico, Ecuador and Argentina leading the list (with hundreds of thousands of detections). The United States are in the top five targeted countries, while the UK and South Africa have also made the top ten.

Indicators of Compromise (IoCs)

Emotet payloads

PSW.Delf.OSF – AZORult

Ondrej Kubovič 23 Nov 2018 – 02:12PM