EMOTET malware communicates with its C&C server to determine what payload to deliver. One possible payload is that the infected machine serves as a botnet that sends spam email to spread the malware. It is also capable of harvesting email addresses from the infected machine, and steals username and password found in installed browsers. For its persistence, the malware is installed either as a service or autorun registry entry is created.
Click image to enlarge.
PRESCRIBED SOLUTION
VSAPI Pattern (Malicious File Detection)
| Layer | Pattern | Pattern branch/version | Released date/time (GMT+8) |
|---|---|---|---|
| Infection | TSPY_EMOTET.AUSJLC | 13.625.00 | 8/30/2017 |
| Infection | HS_EMOTET.SMD0 | 13.625.00 | 8/30/2017 |
| Infection | TROJ_HPEMOTET.SMF | 13.623.00 | 8/29/2017 |
| Infection | TSPY_EMOTET.SMD5 | 13.623.00 | 8/29/2017 |
| Infection | TSPY_EMOTET.SMD6 | 13.623.00 | 8/29/2017 |
| Infection | TSPY_HPEMOTET.SMDX0 | 13.623.00 | 8/29/2017 |
| Infection | TSPY_EMOTET.SMDX | 13.617.00 | 8/26/2017 |
| Infection | TSPY_EMOTET.AUSJLA | 13.615.00 | 8/25/2017 |
| Infection | TSPY_EMOTET.SMD4 | 13.615.00 | 8/25/2017 |
| Infection | TSPY_EMOTET.SMD3 | 13.601.00 | 8/18/2017 |
| Infection | TSPY_HPEMOTET.SMQ | 13.601.00 | 8/18/2017 |
| Infection | TSPY_EMOTET.SML3 | 13.599.00 | 8/17/2017 |
| Infection | TSPY_EMOTET.SMD2 | 13.597.00 | 8/16/2017 |
| Infection | TSPY_EMOTET.SMD1 | 13.589.00 | 8/12/2017 |
| Infection | TSPY_EMOTET.SMD | 13.581.00 | 8/8/2017 |
| Infection | TSPY_EMOTET.SMQ | 13.569.00 | 8/2/2017 |
| Infection | TSPY_EMOTET.SMQ1 | 13.569.00 | 8/2/2017 |
| Infection | TSPY_EMOTET.SMR | 13.555.00 | 7/26/2017 |
| Infection | TSPY_EMOTET.SMO | 13.505.00 | 7/1/2017 |
| Infection | TSPY_EMOTET.SMC | 13.499.00 | 6/28/2017 |
| Infection | TSPY_HPEMOTET.SME | 13.445.00 | 6/6/2017 |
| Infection | TSPY_EMOTET.SMB | 13.437.00 | 5/28/2017 |
TRENDX Detection
| TSPY_EMOTET Detections |
|---|
|
WEB REPUTATION (Malicious URLs and Classification)
| URLs blocked |
|---|
| Total of 165 URLs related to EMOTET were already blocked. (See complete list) |
ANTISPAM Pattern
| Layer | Detection | Pattern branch/version | Released date/time (GMT+8) |
|---|---|---|---|
| Arrival | Spam Mail | AS3274 | 8/21/2017 |
AEGIS Pattern (Behavior Monitoring Pattern)
| Layer | Detection | Pattern branch/version | Released date/time (GMT+8) |
|---|---|---|---|
| Aegis | 2958T / 2959Q | TMTD 1695 | 8/31/2017 |
DCT Pattern (System Clean Pattern)
| Layer | Detection | Pattern branch/version | Released date/time (GMT+8) |
|---|---|---|---|
| CLEAN-UP | TSC_GENCLEAN | latest DCT OPR | Built-in |
SOLUTION MAP
| Major Products | Versions | Virus Pattern | Behavior Monitoring | Web Reputation | DCT Pattern | Antispam Pattern | Network Pattern |
|---|---|---|---|---|---|---|---|
OfficeScan | 11 SP1 and above | Update pattern via web console. | Update pattern via web console. | Enable Web Reputation Service.* | Update pattern via web console. | (not applicable) | Update pattern via web console. |
Worry Free Business Suite | Standard | (not applicable) | |||||
| Advanced/MSA | Update pattern via web console. | ||||||
| Hosted | |||||||
Deep Security | 8.0 and above | (not applicable) | (not applicable) | Update pattern via web console. | |||
ScanMail | SMEX 10 and later | (not applicable) | Update pattern via web console. | (not applicable) | |||
| SMD 5 and later | |||||||
| InterScan Messaging | IMSVA 8.0 and above | ||||||
| InterScan Web | IWSVA 6.0 and later | ||||||
Deep Discovery | DDI 3.0 and later | (not applicable) | Update pattern via web console. |
RECOMMENDATION
THREAT REPORT
- Trend Micro Threat Encyclopedia: TSPY_EMOTET
- Trend Micro Threat Encyclopedia: TSPY_EMOTET.AUSJLA
- Trend Micro Threat Encyclopedia: TSPY_EMOTET.SMD3
- Trend Micro Threat Encyclopedia: TSPY_EMOTET.AUSJKW
- Trend Micro Threat Encyclopedia: TSPY_EMOTET.AUSJKV
BLOGS
Read the KB article on Submitting suspicious or undetected virus for file analysis to Technical Support.
