Emotet

Emotet is a banking trojan malware program which obtains financial information by injecting computer code into the networking stack of an infected computer,^[1]allowing sensitive data to be stolen via transmission.^[2] Emotet malware also inserts itself into software modules which are then able to steal address book data and perform denial of service attacks on other systems.^[3]

Emotet has evolved in its delivery, however the most prominent form has been inserting malicious documents or URL links inside the body of an email sometimes disguised as an invoice or PDF attachment.^[4]

First reported in Germany, Austria, and Switzerland in 2014, the United States quickly followed suit encountering Emotet malware not necessarily through fake invoices, but rather through malicious JavaScript (.JS) files; when the malicious .JS files are executed, Emotet malware is then able to infect the current host.^[5]

Once Emotet has infected a host, a malicious file that is part of the malware is able to intercept, log, and save outgoing network traffic via a web browser leading to sensitive data being compiled to access the victim's bank account(s).^[6]

Emotet is a member of the Feodo Trojan family of trojan malware.^[7] When run in a virtual machine environment, Emotet changes its behavior in ways that are intended to mislead malware investigators.^[8]

References