#mummyspider — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #mummyspider, aggregated by home.social.
-
The prolific #Emotet malware - tracked under the actor #MummySpider and #TA542 - is back after a 3 month break, delivering inflated (~500MB) macro-enabled Word documents via invoice-themed Phishing emails.
The Word documents are contained in a password protected archive, and once opened and the malicious content is enabled, will download the Emotet payload - a similarly bloated dll file, designed to bypass automated scanning solutions that typically can't process large files.
Malware analyst Max Malyutin has a great summary of the ATT&CK techniques and IOCs seen in this campaign so far: https://twitter.com/Max_Mal_/status/1633102894328168448?t=Kn9N3dUIcqul_TTCu1aqzQ&s=19
Analysts may find debloat - a tool that strips guff from intentionally bloated executables - useful in processing samples: https://github.com/Squiblydoo/debloat
#infosec #cyber #news #cybernews #infosec #infosecnews #informationsecurity #cybersecurity #security #technology #malware #soc #threatintel #threatintelligence #phishing
-
🗃️ Emotet
Emotet Being Distributed Using Various Files
🔗 https://asec.ahnlab.com/en/34556/Emotet DLL Part 2: Dynamic Analysis
🔗 https://www.atomicmatryoshka.com/post/emotet-dll-part-2-dynamic-analysisEmotet Moves to 64 bit and Updates its Loader
🔗 https://blogs.vmware.com/security/2022/05/emotet-moves-to-64-bit-and-updates-its-loader.htmlEmotet x64 Stack Strings Config Emulation
🔗 https://research.openanalysis.net/emotet/emulation/config/dumpulator/malware/2022/05/19/emotet_x64_emulation.htmlSince its return in November 2021, Emotet has once again become one of the most prolific malware families.
🔗 https://unit42.paloaltonetworks.com/emotet-malware-summary-epoch-4-5/The Resurgence of the Emotet Botnet Malware
🔗 https://www.trendmicro.com/en_us/research/22/e/bruised-but-not-broken--the-resurgence-of-the-emotet-botnet-malw.html
#microsoft #malware #feodo #cyber #emotet #mealybug #mummyspider #ta542 #botnet #emulation #geodo #threats #x64 #windows #loader #informatique