{"id":4523,"date":"2018-07-09T09:58:48","date_gmt":"2018-07-09T04:28:48","guid":{"rendered":"https:\/\/qadit.com\/blog\/hackers-delivering-emotet-malware-via-microsoft-office-documents\/"},"modified":"2018-07-09T09:58:48","modified_gmt":"2018-07-09T04:28:48","slug":"hackers-delivering-emotet-malware-via-microsoft-office-documents","status":"publish","type":"post","link":"https:\/\/qadit.com\/blog\/hackers-delivering-emotet-malware-via-microsoft-office-documents\/","title":{"rendered":"Hackers Delivering Emotet Malware Via Microsoft Office Documents"},"content":{"rendered":"<p><a href=\"https:\/\/i2.wp.com\/gbhackers.com\/wp-content\/uploads\/2018\/07\/Emotet-Malware.png?fit=648%2C358&amp;ssl=1\"><img loading=\"lazy\" decoding=\"async\" title=\"Emotet Malware\" alt=\"Emotet Malware\" src=\"https:\/\/i2.wp.com\/gbhackers.com\/wp-content\/uploads\/2018\/07\/Emotet-Malware.png?resize=648%2C358&amp;ssl=1\" height=\"358\" width=\"648\" \/><\/a><\/p>\n<p>A new malware campaign that delivers Emotet Malware Via Microsoft Office documents attachments with \u201cGreeting Card\u201d as the document name.<\/p>\n<p>Attackers targeted the USA\u2019s Independence Day to trick users into downloading the malicious document and to install the malware.The Banking Trojan EMOTET was identified in 2014, it has the capabilities of stealing personal information such as username and Passwords.<\/p>\n<h2><strong>Emotet Malware Campaign<\/strong><\/h2>\n<p>The new malware campaign was spotted by Zscaler\u2019s research team and it is active between July 2nd to July 4th, \u201cWe saw over two dozen unique payloads hitting our Cloud Sandbox in the 48-hour span.\u201d said Zscaler.<\/p>\n<p>The document contains a tricky social-engineered message that asks users to <strong>enable content<\/strong> that allows the malicious macro to run in the background. The Macro obfuscated to avoid detection\u2019s and it triggers wscript.exe to run the command.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"Emotet Malware\" src=\"https:\/\/i0.wp.com\/gbhackers.com\/wp-content\/uploads\/2018\/07\/enable_editing_0.png?resize=696%2C332&amp;ssl=1\" height=\"332\" width=\"696\" \/><\/p>\n<p>Wscript downloads the payload through PowerShell script, finally, the De-obfuscated PowerShell command parameters download the Emotet payload and drops in the temp directory.<\/p>\n<p>Emotet is a widely distributed malware it is commonly distributed via malicious spam campaigns that contain office documents, every time it emerges with new capabilities.<\/p>\n<p>It is a multi-component malware that is capable of stealing credentials through browsers and email, Man-in-the-Browser attack and email harvesting.<\/p>\n<p>With the last campaign, it includes a future called RunPE, that hides malware into the Legitimate process to evade the security scanners and inject its code into windows executable process.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new malware campaign that delivers Emotet Malware Via Microsoft Office documents attachments with \u201cGreeting Card\u201d as the document name. Attackers targeted the USA\u2019s Independence Day to trick users into downloading the malicious document and to install the malware.The Banking Trojan EMOTET was identified in 2014, it has the capabilities of stealing personal information such &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/qadit.com\/blog\/hackers-delivering-emotet-malware-via-microsoft-office-documents\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Hackers Delivering Emotet Malware Via Microsoft Office Documents&#8221;<\/span><\/a><\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[],"class_list":["post-4523","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9AH7Q-1aX","_links":{"self":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/4523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/comments?post=4523"}],"version-history":[{"count":0,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/posts\/4523\/revisions"}],"wp:attachment":[{"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/media?parent=4523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/categories?post=4523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qadit.com\/blog\/wp-json\/wp\/v2\/tags?post=4523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}