Exploring Emotet, an Elaborate Everyday Enigma presented at BSidesLondon 2019

by Luca Nagy,

Summary : The Emotet Trojan is the most widespread malware family in the wild. It has been, and is still, the most notorious and costly malware since its appearance more than five years ago. Emotet owes its reputation to its constant state of evolution and change. The malware's rapid advancement helps support its highly sophisticated operation. In this presentation, I'll walk attendees through my investigation of the Emotet family and reverse engineering of its components.In this talk, I'll discuss the capabilities and features of Emotet: a detailed overview of its multilayered operation, starting with the spam lure, the malicious attachments (and their evolution); and the malware executable itself, from its highly sophisticated packer, to its C&C communications.Emotet is well-known for its modular architecture, worm-like propagation, and highly skilled persistence techniques. The recent versions spread rapidly using multiple methods. Besides its capability to spread by brute forcing using its own password lists, it can harvest all the emails from victims, then spread through spam. Its diverse module list hides different malicious intentions, such as information stealing including credentials from browser or email client, spreading capabilities, or delivering other malware as well as ransomware or other banking Trojans.Finally, I will dissect the background operation of the payload modules. I’ll also present statistics from Sophos about its global reach.