April 20, 2019
Home » emotet malware

emotet malware

Cyber Attack  / Malware
Emotet Trojan Hacked Uniden Commercial Site Serves
Moseley (Raam) Posted On April 12, 2019

Emotet malware

Uniden’s website was pursued to host a Word document that provides what appears to be a variety of Emotet Trojan gardens, also known as Geodo and Heodo.

Compared to Uniden’s main website offering a wide range of electronic products (radios, scanners, radar detectors, dash cameras, cellular boosters), cameras (IP, analog) and network video recorders (NVR) are the only solutions available in the commercial sector.

Emotet sitting nice and snug

The malicious Word file is stored in the “/wp – admin / legale/” folder and contains a macro that downloads an apparent variant to the Emotet URLhaus URL, a project from abuse.ch that collects, tracks and shares malicious URLs with security professionals and network administrators.

With the help of 265 volunteer security researchers, the URLhaus project has contributed to the dismantling of 100,000 websites active in malware distribution over a period of about 10 months.


The malicious document can supply three JavaScript payloads according to the URLHouse analysis and all of them have signatures for Heodo, another Emotet name.

All three are currently detected by 26 VirusTotal scanning antivirus engines. The malicious macro Word document is now detected as a threat by 20 anti-virus engines operating on the same service.

Macros in common suites, such as Microsoft Office and LibreOffice, are disabled by default, but cybercriminals have turned to social engineering to find out the victim is using the script and so start the malware download routine and give clear instructions on how to do so.

The company has been notified

Where the malware is being installed on the website is unclear, but it still exists at the time of writing, despite the company being notified of the situation on Twitter more than 24 hours ago.

The company has also received an email from BleepingComputer requesting a statement about this situation but received no reply at the time of publication.


Uniden is a major electronic equipment manufacturer, but the popularity of an organization and its size are no reason to discourage cybercriminals from hacking and storing malware.

Recently, threat scientist MalwareHunterTeam tweeted about a similar situation for his Computational Photography Lab, which had several malicious payloads, some of which were Shade ransomware, on the Northwestern University domain.


In this case it also took administrators more than a day to remove threats since the notification time.


Continue Reading
0
88 Views


Malware
A Data-Stealing Malware – Emotet is back and it is targeted Kenya
Moseley (Raam) Posted On January 2, 2019

Data Stealing Malware Emotet

According to CAK (Kenya Communication Authority) Emotet malware has penetrated the East African country of Kenya. All public institutions, including the vulnerable banking sector, are warned that they need to be alert to any suspicious activities on their network, as Emotet targets bank – related systems through fake notifications, pretends to alert bank accounts and convinces e – mails.

We recently reported on the re – emergence of Emotet as a damaging malware in the wild on 17 November 2018, which was aimed at European computers, in particular Germany. It seems that it has entered African territory with Kenya at its crosshairs. As a result of this writing, 11 infection incidents have already been recorded in Kenya by its National Computer Incident Response Team Coordination Centre, most of which have been attracted by clicking on malicious genuine payment invoices and fake shipping operations.

“Typical signature – based detection can be avoided and there are several ways to maintain persistence, including auto-start registry keys and services, “explained Tom Olwero, CAK’s Director General. Even incidents have occurred in which the malware has been spread through fake Paypal transactions, with the unsuspecting user filling up a pretentious form that requires their username and password. People who fall into these schemes are in great danger with identity theft, the modus operandi of robbing user data through disappointment and using the stolen data to disguise them as the original owner.

Emotet malware can also collect information on the colleagues and acquaintances of a victim stored on the computer. This information can also be used to attack such acquaintances. Email can be used to find a circle of friends, and coworkers can be identified by shared email domains. Such information can be used to carry out highly targeted attacks on people who have a relationship with the first victim.

Kenya is not unique in any way as far as virus infiltration is concerned, as the 3rd quarter of 2018 saw a record of 3.8 million incidents of IT problems, a record increase from just 3.4 million in the 2nd quarter of 2018.


Continue Reading
0
367 Views