Emotet

Emotet說明

Emotet Image

Emotet大約是五年前開始的，是一家銀行木馬，但如今已經發展了許多。如今，它已成為世界上最危險的殭屍網絡和惡意軟件丟棄程序之一。為了充分利用這些攻擊，Emotet經常丟棄新的銀行木馬，電子郵件收集器，自我傳播機制，信息竊取者，甚至勒索軟件。

安全研究人員指出，Emotet背後的威脅行為者於2019年6月開始了一個暑假，其中連指揮與控制（C2）活動都停止了。但是，隨著夏季開始得出結論，安全研究人員開始看到Emotet的C2基礎架構的活動有所增加。截至2019年9月16日，Emotet已完全依靠社交工程全面開展垃圾郵件運動。

Emotet感染受害者的最巧妙和令人生畏的方式之一是通過電子郵件內容的竊取。該惡意軟件會輕掃受害者的收件箱並複制現有對話，然後將其用於自己的電子郵件中。 Emotet會以“回复”方式引用真實郵件的正文，以受害者的未讀電子郵件的形式發出，以誘使他們打開帶有惡意軟件標記的附件，通常以Microsoft Word文檔為幌子。

看到有人希望以這種方式欺騙正在進行的對話是不需要多少想像力的。此外，通過模仿現有的電子郵件對話（包括真實的電子郵件內容和主題標頭），郵件變得更加隨機化，並且很難被反垃圾郵件系統過濾。

有趣的是，Emotet不會使用竊取內容的電子郵件將其發送給潛在的受害者。而是將解除的對話發送到網絡中的另一個漫遊器，然後再使用完全獨立的出站SMTP服務器從完全不同的位置發送電子郵件。

根據安全研究人員的說法，Emotet在夏季中斷之前使用了大約8.5％的攻擊消息中的竊取電子郵件對話。但是，由於假期結束了，這種策略變得更加突出，幾乎佔Emotet的所有出站電子郵件流量的四分之一。

總之，隨著假期的臨近，我們將看到惡意軟件感染的增加。正如Cisco Talos的研究人員指出的那樣：“當威脅組織保持沉默時，它們永遠不會消失的可能性很大，”他詳細闡述：“相反，這為威脅組織提供了以新的IOC，戰術，技術和方法返回的機會。可以避免現有檢測的程序或新的惡意軟件變體。”

技術信息

屏幕截圖&其他影像

Emotet Image 1 Emotet Image 2

文件系統詳情

Emotet創建以下文件：
# 文件名 大小 MD5 檢測計數
1 %WINDIR%\syswow64\licensefwdr.exe\licensefwdr.exe 131,072 3391006372b212ba0be34bf9cc47bb15 60
2 c:\users\vtc\downloads\8e8cmlbo6fx_lxfm3xki.exe 582,656 0d87835af614586f70e39e2dfdba1953 41
3 %WINDIR%\system32\guidsdefine.exe\guidsdefine.exe 231,424 8af726850d90d8897096429c8f677fb9 34
4 c:\users\vtc\downloads\xppvz6oh.exe 156,672 e7a1127484bbd79f4de0460ee92836fb 14
5 c:\windows\syswow64\ni6tj3f0c.exe 143,360 865eba9b4ee8e93f500232eae85899f9 14
6 c:\users\vtc\downloads\fcuthenucs_qzfm9unm.exe 230,400 fc620fb26d06a3f15e97fa438e47b4e3 13
7 c:\windows\syswow64\sw1bo.exe 139,264 6957fc973e45d6362c9508297840332c 13
8 c:\users\vtc\downloads\hh_u6zt3e3q_vmytcj.exe 239,616 0c12b6e792d5e395f1d0e8e00f2a906b 9
9 c:\users\vtc\downloads\8lqwejk6.exe 159,744 9ab8c51587e3a46950576c545d917e5f 8
10 c:\windows\syswow64\guidsripple.exe 143,360 954d6e95ef173331841a54b2bacbcd28 8
11 c:\users\vtc\downloads\z7w2_qj.exe 348,160 59dec5b309f882bd3b7b7f4db9de8810 7
12 c:\windows\syswow64\ripplepolic.exe 155,648 d3fe0e7a94cf8a04435ecd85d1a85227 7
13 c:\users\mark\211.exe 139,264 831bbafd3a5596994e3e5407e86a6ab0 6
14 c:\windows\syswow64\s9nevcf77pvpbcahes.exe 139,264 9f6d496199d712df75fea0d4f65a774d 6
15 c:\users\vtc\downloads\9tadwtpw5estit.exe 159,744 b25ec6e225cf6247dcb3810470ae86b7 5
16 C:\ProgramData\სკუმბრია.exe 782,336 35c973fee6e0f6fd1c9486d25d041c83 5
17 C:\ProgramData\ↇↂↂↂ自転車выпLXXX;ↇↂↂↂ;ЧыПبايسکل.exe 548,864 9d7b1ffdd0d6e8e43032b16dabcb52b4 5
18 c:\users\vtc\downloads\fu_nid7mlnsu.exe 151,552 fecc9b87f6adde022e2e7540469d9668 4
19 c:\users\vtc\downloads\td5g1cst.exe 223,232 d42dbba27dc711e5b4a3f4bf83967049 4
20 c:\users\vtc\downloads\cvedvfdyaj.exe 232,960 e60048bfaab06dcab844454c33ad5491 4
21 c:\users\vtc\downloads\aizz7dugmz_ddw.exe 241,152 149f8faf3bb1c3cbd1207c133715a480 2
22 c:\users\vtc\downloads\h7kg8jsthbc.exe 224,768 c6c70da245a63f7ae7052ebac3fb76c6 2
23 c:\users\vtc\downloads\troj_generic_ec086af0e56b97ea6b427f02f90def0897bb0fe578eed1d48bf33049e4c9d439.exe 403,456 536d98819ef25d5452ef802d4541bb46 1
24 c:\users\julius\downloads\bc117e6ae77ef72ad0131990943d7a8b3570f0eb9fbe9a7a41e7e43711e5f763.crdownload 409,600 83e70065bf06162895e73ce43f4fdb19 1
25 c:\users\julius\downloads\eb7f8d53312376570fbd1385b45d1ff3fab6faadfba6c3a3a6c9d30c5e31bb4d.crdownload 339,968 1f4a1df52756bd6ea855b47f039836ee 1
26 c:\users\julius\downloads\1be6989616522d6ae9b3c301e5f51f0ac0313dfc8497958c616a307cd09657fc.crdownload 339,968 991bd07e70c478affb777a3728942591 1
27 c:\users\julius\downloads\aba5311be7e0dfbfefdd1f545a701b4e81c9ad8790af6f58f827e6b54f3454e5.crdownload 409,600 a4d00e6314149af840bbbf7a70bf1170 1
28 c:\users\julius\downloads\a9a90901ee38e8a232e253f00b9fc9c0f0f58620ef6b7692e6dc7342a7317c1d.crdownload 409,600 6f68c6733db5e38ba4cd82d12e683696 1
29 C:\Windows\11987416.exe 不適用
30 C:\Windows\System32\46615275.exe 不適用
31 C:\Windows\System32\shedaudio.exe 不適用
32 C:\Windows\SysWOW64\f9jwqSbS.exe 不適用
33 C:\Users\\AppData \Local\Microsoft\Windows\shedaudio.exe 不適用
34 C:\Users\\AppData\Roaming\Macromedia\Flash Player\macromedia\bin\flashplayer.exe 不適用
更多文件

註冊表詳情

Emotet創建以下註冊表條目：
Regexp file mask
%APPDATA%\microsoft\vhmjoh\vhmjo.exe
%APPDATA%\SetingSync64.exe
%WINDIR%\System32\sysnet.exe
%WINDIR%\SysWOW64\HawaiiAppointment.exe
%WINDIR%\SysWOW64\nvapp.exe
%WINDIR%\SysWOW64\policsource.exe
%WINDIR%\SysWOW64\slsbthpan.exe

網站免責聲明

Enigmasoftware.com與本文提到的惡意軟件創建者或發行者沒有關聯、贊助或擁有。不要以任何方式將本文與推廣或認可惡意軟件相關聯，將其誤解或混淆。我們的目的是提供信息，以指導計算機用戶如何借助SpyHunter和/或本文提供的手動刪除說明來檢測並最終從計算機中刪除惡意軟件。

本文按“原樣”提供，僅用於教育信息。按照本文的任何說明進行操作，即表示您同意受免責聲明的約束。我們不保證本文將幫助您完全消除計算機上的惡意軟件威脅。間諜軟件定期更改，因此，很難通過手動方式完全清潔受感染的計算機。

發表評論

請不要將此評論系統用於支持或結算問題。 若要獲取SpyHunter技術支持，請通過SpyHunter打開技術支持問題直接聯繫我們的技術團隊。 有關結算問題，請參考“結算問題？”頁面。 有關一般查詢（投訴、法律、媒體、營銷、版權），請訪問我們的“查詢和反饋”頁面。

由 GoldSparrow 在 Trojans
翻譯為： English Albanian Chinese (Simplified) Croatian Czech Danish Dutch Español Finnish French German Greek Hungarian Italian Japanese Lithuanian Norwegian Polish Português Russian Swedish
Threat Scorecard
?
The ESL Threat Scorecard is an assessment report that is given to every malware threat that has been collected and analyzed through our Malware Research Center. The ESL Threat Scorecard evaluates and ranks each threat by using several metrics such as trends, incidents and severity over time.

In addition to the effective scoring for each threat, we are able to interpret anonymous geographic data to list the top three countries infected with a particular threat. The data used for the ESL Threat Scorecard is updated daily and displayed based on trends for a 30-day period. The ESL Threat Scorecard is a useful tool for a wide array of computer users from end users seeking a solution to remove a particular threat or security experts pursuing analysis and research data on emerging threats.

Each of the fields listed on the ESL Threat Scorecard, containing a specific value, are as follows:

Ranking: The current ranking of a particular threat among all the other threats found on our malware research database.

Threat Level: The level of threat a particular computer threat could have on an infected computer. The threat level is based on a particular threat's behavior and other risk factors. We rate the threat level as low, medium or high. The different threat levels are discussed in the SpyHunter Risk Assessment Model.

Infected Computer: The number of confirmed and suspected cases of a particular threat detected on infected computers retrieved from diagnostic and scan log reports generated by SpyHunter's Spyware Scanner.

% Change: The daily percent change in the frequency of infected computers of a specific threat. The formula for percent changes results from current trends of a specific threat. An increase in the rankings of a specific threat yields a recalculation of the percentage of its recent gain. When a specific threat's ranking decreases, the percentage rate reflects its recent decline. For a specific threat remaining unchanged, the percent change remains in its current state. The % Change data is calculated and displayed in three different date ranges, in the last 24 hours, 7 days and 30 days. Next to the percentage change is the trend movement a specific malware threat does, either upward or downward, in the rankings. Each level of movement is color coded: a green up-arrow (∧) indicates a rise, a red down-arrow (∨) indicates a decline, and a brown equal symbol (=) indicates no change or plateaued.

Top 3 Countries Infected: Lists the top three countries a particular threat has targeted the most over the past month. This data allows computer users to track the geographic distribution of a particular threat throughout the world.
Ranking: N/A
Threat Level: 8
Infected Computers: 4,237