Emotet banking trojan debuts in U.S.

itman · May 4, 2017

A banking trojan that was first reported in June 2014 targeting banks in Germany and Austria and later in Switzerland has made its way to these shores, according to a blog post from the Center for Internet Security (CIS).

The trojan arrives in phishing emails embedded in a malicious PDF targeting federal, state, local, tribal and territorial (FSLTT) government employees. The emails appear to be documents and invoices from well-known organizations but are fake.

Emotet is an iteration of the Feodo trojan family, the CIS explained, which also includes Bugat and Dridex.

While the latest campaign bears similarities to the earlier U.K. campaign, the CIS researchers pointed out that rather than attempting to dupe recipients with a fake phone bill with malicious links, as the U.K. spam did, the scourge in the U.S. employs malicious PDF file attachments with a link to javascript (JS) which recipients are prompted to click on. As well, rather than relying on fake invoices, as was the case in the U.K. campaign, subject lines of the new variants pretend to be billing notices or urgent reports.

"Once the .JS file is run, it makes HTTP GET requests over port 8080 to the command and control (C2) IP with what the MS-ISAC believes is identification data encrypted within an encoded cookie string," the CIS report stated. Researchers at both Forcepoint and MS-ISAC recognized that the .js strings in both the U.K. and U.S. campaigns were similar: heavily obfuscated and containing a large batch of junk code.
Click to expand...

https://www.scmagazine.com/emotet-banking-trojan-debuts-in-us/article/654652/

itman · May 4, 2017

Of note as evidenced by this malware, have you disabled JavaScript in Adobe Reader? It is enabled by default.

Also obviously, the .pdf would have to be opened outside of Reader's protected mode.

Log in or Sign up

Emotet banking trojan debuts in U.S.

itman Registered Member

itman Registered Member

Log in or Sign up

Emotet banking trojan debuts in U.S.

itman Registered Member

itman Registered Member

Useful Searches