Alpha Team Flash Report: Emotet Campaign Disruption

On January 27th 2021, Europol announced that Emotet, a botnet that has existed since 2014, was disrupted by a multi-country law enforcement effort. This was a joint effort between authorities ranging from Germany, Netherlands, United States, United Kingdom, France, Canada, and others, coordinated by Europol, which was able to take control of the infrastructure used by this botnet. The effort injected sinkhole IP addresses into the botnet to neuter infections from the command and control (C2) level, as well as resulted in the arrests of multiple botnet operators across the world.

Recommendations

Review network logs for communication between internal devices and IP addresses listed in the Indicators of Compromise section of this report.
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
Always verify the sender of suspicious or unexpected emails and messages
Never download attachments from unknown senders or suspicious emails
Never click on links or enter credentials when prompted unless you have checked the URL and purpose of the request is legitimate
Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

Discovered in 2014, and believed to be based in Russia, Emotet started as a banking trojan targeting hosts for banking credentials. From there, it pivoted into becoming a well-known “loader,” which would be used as an initial infection to gain access to systems, and then allowing operators to download additional payloads, like TrickBot, Ryuk, and Qbot.

Emotet used phishing emails with malicious Microsoft Office documents to infect machines, with lures including invoices, shipping notices, and more recently COVID-19 information. Once these documents were opened, users were instructed to “enable macros” which would allow the malware to run on the victim’s machine.

At its peak, there were three active botnets categorized as Epoch 1, Epoch 2, and Epoch 3 which were active simultaneously that involved hundreds of machines all over the world performing various functions to continue operations. These Epochs had multiple redundancies in place, where a failure in one C2 node along the chain could be compensated for by other C2 nodes.

Due to the coordinated efforts by Europol and the countries involved, authorities were able to route infected machines to law enforcement controlled infrastructure, effectively neutering the malware service.

Infection Vector

In 2020, Emotet distributed two types of phishing emails: short and simple messages and sophisticated templates exploiting popular brands and current events. Examples of the latter category involved the actors spreading phishing emails using COVID-19 and US presidential election-themed lures. The actors also incorporated social engineering techniques in their lures to make the phish more enticing to their targets.

When a target receives an Emotet-delivered spam message, it typically contains a malicious link or attachment that downloads a Microsoft Office file, usually a Word document or an Excel spreadsheet. The file contains a malicious macro script that is responsible for downloading additional malware binaries to the target device--a machine running a Microsoft Windows operating system. When the victim opens the Office file, they are instructed to enable macros that allow the malware to proceed with the infection process in the background of the environment.

One of the more common malware pairings is Emotet and Trickbot. Trickbot was commonly delivered via Emotet, and in 2020 the malware went through a brief takedown disruption period. During this time, Trickbot threat actors attempted to restore the malware after Microsoft and US Cyber Command disrupted parts of the malware’s infrastructure. In order to keep Trickbot operations running, the threat actors substituted Trickbot for other information-stealing malware, such as QBot, while leveraging Emotet capabilities to distribute their malware. In terms of ransomware, Emotet and Trickbot distributed the Ryuk ransomware in phishing campaigns from 2019 to 2020. By leveraging a botnet malware, information stealer, and ransomware in a single infection chain, threat actors can extract copious amounts of sensitive data that result in lasting consequences for victims.

Emotet exhibited some notable characteristics that make the botnet incredibly sophisticated, yet destructive. This is due to the threat actors constantly updating Emotet’s codebase and using creative techniques to distribute the malware to their victims. Emotet is highly evasive and can bypass some security technologies and gateways in order to infect its targets. It also has spamming features that allow the malware to traverse through networks to target more machines. The group has also been involved with injecting malicious links into old email threads to trick victims into believing they are responding to a legitimate email.

Summary

While this takedown has most likely disrupted this crimeware operation, it is not fully known how much damage this did to the operators managing the malware service. In addition, since Emotet was used to install other malware on systems, simply removing the infrastructure will still lead to more cleanup efforts to remove any additional malware that was installed on victim machines.

However, law enforcement officials in the Netherlands plan to release an Emotet update in March 2021 that removes the malware from infected computers. According to Europol officials involved with the disruption effort, the takedown prevents Emotet threat actors from selling access to Emotet-infected machines to other [threat actor groups].

There are a lot of unknowns left after this takedown, and it begs the question if any other “Malware-as-a-Service” (MaaS) steps in to fill the void left by Emotet. We assess that this won’t have any impact on current malware operations, due to these groups already knowing potential risks, and a large takedown effort of this scale will likely not prevent other MaaS actor groups from suspending operations.

Indicators of Compromise

ZeroFOX Threat Feed users can access URL's and SHA256 hashes related to Emotet via campaign ID 125

Sinkhole C2s, TLP:AMBER
hxxp://80[.]158[.]3[.]161:443/
hxxp://80[.]158[.]51[.]209:8080/
hxxp://80[.]158[.]35[.]51:80/
hxxp://80[.]158[.]63[.]78:443/
hxxp://80[.]158[.]53[.]167:80/
hxxp://80[.]158[.]62[.]194:443/
hxxp://80[.]158[.]59[.]174:8080/
hxxp://80[.]158[.]43[.]136:80/

SHA256 Hashes (Active as of 2021-01-26)
Epoch 1
bdfd63fb6d6470c88f4ff16afa74f98393ca081c8cad43286638346ad3d37dfe
fced3c3da291ca9404e83af3c9e214acf637bd382a0643d3fc0a6403207df233
8f93c092f73d368e551f6fa2fad40c4b0e759fcce89f919855eaa12a0c96948e
3e4d9a83ec504d8bf7a9e0ee976882d0c396e7913b9b08f65e7b9ca498439cdf
c18cf81874fe28d89c845b79794f5152f5e3914a2b276c030b791f109de7bb00
b37bbe424c878e7047e7f227e453a0dd116a379e3226087eef20c9cb58188804
bfd2a05d9bba662abd1f15084a932ee50bd29accf3534488a512e8c7b4956a69
0b3c8c9ad07157288b7851fbffcdcd85e6a318c7f441be2515589d76b9b9676a
93d6e0b5fd29d5ef1e0457c1b2010dc1aeb0ee1bd672a0321f6b714eb55d42f8
db23db5467dc8f0b0dfa39f89ec46943411b27a5e9c0357bd78bfb32eb6144cd
e7d3602f502eb0b1618429930e75760d0ca115a7be49ed069f5aea689af57870
5c18dc90343e1af8e62053f589532a19eddb42396190daea82ea44318943bce1
30b93281763e90d47ec2469ed87c93fcfc59d03a34af07fe760b9a3df0a9702f
3957fd94a8b63c71ad84cc6e2529ff230647e36a96dcc4e982b3855206d12e52
74072d7cebb5704cf2205d4afa1eaaa622676a333102ba5469ca92891e759d95
3d95011a36db23b18ec2ddb0540a1af69ca088cec1c1b8f4fc9641c0c5043560
a1fe19eb6ef590d2ee2b509c6f6c7964698ec54e14f73ca299336b6bf5a6d536
73cb07c945fe2014e0aed0369079ef95cc5cd405077eb94136336e8c49231153
7b355bdfe4419b5379936b0ddee4462836a3330ccf3e8d6f851faeed4b86ee48
558999ed36a39090301c915e39a8861f3bc59a5ae9ecb614ad436ae83f2a6f54
c4b56cb3c89d0194d42bb138911e1276b376c620c2d464a71294e01c4b99f29f
a3fd7815ab8c3c107e7993ce7c50636dffb66001c018b7f1d9fcb4603e8151f9
9bb67a3f2f140f5db086ffe00f5d27e6631448120d7f5d59cbea007bf27650fa
e16a8492c827219bb6f429bd94afff7de6eb383327c9f7215ff591664e6f6c07
fa227d10a96ea2b203f0a6ab52e44a90ee12cb681dd56263232badf9eb4f24d2
0fd81fb31ab99b116414a03092687e7d98d057387727460e0bbe809a6178b62d
485227bce45c59eb878b808df89e60f342215d39ac186c773dba884cdda21ace
70f22c98469ee47b713d7ccb0cf17dc230fbca10aa6af35aa44eca2c126b840b
b40a891aad0a37d88117eb4480acfb36628179af43625cd8b67c1ce000fc8fe9
63dfe037c27b99d0e56f885c19def87a04eb29bdd85de70182a940c0d62713a2
e312abff480a58178f098de492fdb0634856aa6da02f7c32863ec1db1199cefa
e6c0002126693ce3c1b1e34428af32ece371f29030ec7ed7fff6d65c1a64f13d
31407577ae4fd9871ac493ede06c060d96b1525e582498bbfd3c94fa2c3b2148
6f0661474263dea4b546d44d806919a70169dc9d0e2eb129773836df22174d0a
56d68f25e8675636723f8623aa9abde0a363238cb3d09e842507ebc0584c8d6e
96d6da85365ea8b3f051b8284be5972daf06a060cdb8bf7f7dc97c5ae4ec95b2
40072de5b1f4daed12a0ebc7514cbb754bbb927e572fe6cd747074b686b2d3e4
91cf53eef169ffa1e27e2ddc66979a3b5c2659ec618c4be4553bb2f538929071
d09bace1490f6ee322262ff2da373e861f3b3b9bc03c386ce8a031648f1eaa4f
4759eabd2d5136021aea2257a0f203f7090c71e38d437af6eac36c17ea5e8b44

Epoch 2
1eecf0f725c19ee52789332964557e750eb40e2cc5a3166089f476bab7ec5d79
3363cb87e794a733304d0f6ed7819d08a9e2947239fc978bc17bcaa213134146
871cb569a95e8bf40dd59ebb85fb83d4d2da75239891a9daa665d29872fd1c91
325c5b9a249e2e4131303027a1102e3aaacd213ef52ba776ef87cb721f3ed307
7f1845b6f27576b8d3f2b8123777a77ecdd388de19baff31bc5e069880f0cfb7
8a5c1b7bf29060ea596ae0d4bc8a0eac1b104c76ed8b9959bdade8df4344ff4f
1f6567578ef58c6be2d7113ab9abc2c487952fe073cdb2e0132497d35983c4e2
ca16433c97c81cf22d66e943e2cdce89c8453b87a84b1ce4405e98c1d934339c
e603608b774f1c3144afdfd7b959d3ca2ed3d7932d6e7d7908287e4a0da5964e
d4827ee5203aa425a265c49fa198539f7f46ae8ad97bdfe4dba1f17ac7799bb1
8603132f260f7dce47ec17236cd9b08a0281e9948fd50524386dcad8f7f72d01
2a17871c84820e097714859d00c7c11c94a72e5d8e0cd93c8448c2fd8417d03c
d603c358137a2762592f6850b64bb320415dacf2376539aa720f67e23b4bc207
e1770a9b08a9d0b4a254aa19132456a7f1e6892ff2f101979df4853f76ede7a6
6fce1a4c1c50d35994f12e833875d2aba80323a6a18d5408fbdb7ffb80102b28
b141e8279f594c1413a637d8de3abcb903ace6bccf76399a3ca4e80c4b10d41e
09c323bde291f47a0feac6e7938518e96a575104e4297dba15698e96392c4b8e
3a13de32c429219e409ac71af00840ea3f8e3f3c87d8e75feffacdef3672479f
0e6668dea63b61ccbdb65b0c984a1ade5928b81e782601a6b77fb8fbfc278d96
1783449ae781d4e24576a7bd6112ae484829d1d1e943dba9c5b13788f96eb486
70b90abd981e7c31337c04cea5ddc5676ec936161843434417aa7d6e11a0a34e
2a1ed9f5aeb88d0d024933eeae53d3a60214ca13c01fa9b2b08e0ab4fab91160
b81c0e488cca63029b6008973ca3b54982fff870b154c4a84072456f53d7502f
7e7cf37c9525c9c82f8035769a2d9d14b005f332e21b9e2843c7be75f5fd8ae2
5d9e2ea94a0f57bee2dadf402627db9213c91854f499b396d792663c543654c9
60a0bcffdff92533c3529262360c17138a6f9451f37d6283cf321ea66d88e158
52533fe21e7a85f9321fb7d464b50aeae8be6ae9e4603001df6b50b1b6f228c5
fbc2e951a30038ec41d7e370de3dc8a4c0c27d84ba21faf33c1062277c8c90b2
5540f38d5aea762d495d7090dc1a89da722637c111890448571ad163419d234e
630a9699821f02c51a0205d8e9910aeb3a6341b655d3f55bedc147cbe2adeef4
53a00c2701b169ca12685b3f0647f23d75365004a0ac2c8760a610a0fc0e106f
1a44fbce4b150cde78f67e05e58c027f7212a12bd351ac54c8e2b3f9eb870d5d
8c11a8e253bd5e4525de774fc67962bb8e51078385ec92c5547312a3b8bd88e2
ead9c2e5d425e25f650963bcbb68a544e073ac50938b75d37d1aebd1df4a9397
e153901bfef45c34c87d3d182bba6ef158e46464280a921f69efc5c11c2c765a
c5018a296b4e0faf02bfee3e646353a51f3aa6a6185d8db3823e9a73fbdb287b
7e77d551f616709105f92fce7f58f3db11b028eb743bff971f704e332675094e
41c719ec86b80b28e20279ac8d291fc3f883435de594d37740716033b03c3e9d
ab5f36ac16b675411be665102e9073fe0c57744ccdbd490002969c1429a63a39
8f976592470a09993e8612e18d59afd863606baa36553aa73894327373050098
cfcb4ad1df695d4a7ab66751f34997776408c4f6f91b8b869d979d3e544cf782
4e0b12e7331e1adadce11cadd640c84698e619718bf9387d3177862a8cb13213
ec19c82129441903ebcef964fee4f5f61e98b0eaa528cb2ac786c5ff68bcac99
71bc19b3748ecda9ccc9c76ff6317d38bdacc55a3537b377b260ffac52c73a07
52d1df6fe5d4369e5369eb2095161974d726b4b2e636544201c204528bad571d
5ee83f8fd3dac967ce5eb4e06f4d4762b3c0a832bc5d276dbea72871651c3514
ab7eca2bed6ca9975ca0ac4f817ebe1911374ee93420b020eb1e48b77514211d
734bf5656c8b2d19692fc207cdd23471910411fd166165e33094c71c4728158d
f643c19b061911b8ddb5653bdab6e6e1b561ae776083405c001180a92e3cb085
2672e9cc9cd038327a7147b6d791468e7fff4ded6bf145550e12588d95a15ce4
0d4dcf25c93fba0975709ae6566f223c9e50410cdb97f068fbdac6571d42be07

Epoch 3
3690f38b8bf113ce747f3b1d39ee0013fa56a525a7c87287ae72544819413f13
2cd1c91d8bfd268fba4471ca4cbc1415eb61b4c76832ebd99a2cbee452f9d1dd
9ecf542f504924626c0f18758a259f50e4e2f02d74c9b940bf291d4887bde56d

URLs (Active as of 2021-01-26)
Epoch 1
hxxp://shannared[.]com/content/lhALeS/

Epoch 2
hxxp://haumaguerraevoceoalvo[.]com[.]br/wp-includes/0Hm
hxxp://paulomarciotrp[.]com/z/y/