Network Spreading Capabilities Added to Emotet Trojan

itman · Jul 21, 2017

Another worm to worry about. However, this one might not be software delivered.

Researchers at Fidelis Cybersecurity have spotted a variant of the Emotet Trojan that has what appears to be a feature designed to help the malware spread on internal networks.

Emotet, also known as Geodo, is related to the Dridex and Feodo (Cridex, Bugat) malware families. Emotet has mainly served as a banking Trojan, helping cybercriminals steal banking credentials and other sensitive information from users in Europe and the United States.

In the attacks observed recently by Fidelis, Emotet has been used as a downloader for several other banking Trojans based on the victim’s geographical location.

The spreader component seen in attacks over the past month is designed to enumerate network resources in an effort to locate shares to which it can write a file and create a remote service. The service, named “Windows Defender System Service,” writes the malware to the disk and executes it.

If a shared resource is password-protected, the malware will try to guess credentials for user and administrator accounts by launching a dictionary attack.
Click to expand...

http://www.securityweek.com/network-spreading-capabilities-added-emotet-trojan

itman · Jul 28, 2017

Banking Trojans Add Self-Spreading Worm Components

Two banking trojans — Emotet and Trickbot — have added support for a self-spreading component to improve their chances of infecting other victims on the same network.

This is something new because until recently, banking trojans didn't come with self-spreading modules, being focused mainly on remaining undetected and gathering user credentials without alerting the victim.

Emotet

Emotet's self-spreading component for laterally moving inside a network should not be confused with its propagation module that relies on extracting contacts from email clients and spamming each victim with malicious emails.

This banking trojan is one of today's most active threats, and besides helping crooks collect banking credentials and steal money from bank accounts using surreptitious MitB (Man-in-the-Browser) attacks, the trojan is also used to collect credentials for social media accounts, or even drop other malware on infected hosts — a.k.a. working as a malware downloader.

TrickBot

The second banking trojan spotted sporting a self-spreading worm-like module is TrickBot, a banking trojan that last month expanded its targeting to web-based CRMs and PayPal users.

TrickBot has been seen distributed via spam sent out via the massive Necurs botnet, and a sample discovered this past week included a new SMB worm module designed to spread the trojan to nearby computers on the same network.
Click to expand...

https://www.bleepingcomputer.com/ne...f-spreading-worm-components-because-wannacry/

Log in or Sign up

Network Spreading Capabilities Added to Emotet Trojan

itman Registered Member

itman Registered Member

Log in or Sign up

Network Spreading Capabilities Added to Emotet Trojan

itman Registered Member

itman Registered Member

Useful Searches