Emotet malware is one of the most widespread malware , and criminals who use it exploit current events to trick users into downloading it onto their computers . For example, hackers took advantage of Halloween celebrations and sent spam emails that purported to be invitations to a Halloween party.
Emotet is primarily spread through emails containing malicious Word documents (with malicious macros). If victims open the documents, they will be prompted to enable the macros, which download the Emotet malware to their computer.
Once installed, Emotet will use the computer to send more spam messages and install other malware, such as ransomware. Emotet malware is often the first step in a ransomware attack.
Invitation to a Halloween party
The gang behind Emotet created an email inviting recipients to a Halloween party. The email included a malicious attachment.
The experts observed that the subject and the text of the email were presented in a different way, however in all cases it was an invitation to a Halloween party. All the “details” were found in the malicious attached document.
One of the emails the victims received said the following:
“Dear,
If you are coming it would be good!
Details in the attachment”.
According to FireEye, the different names used for the malicious Word attachments included:
- Inviting friends to your Halloween Extravaganza.doc
- Halloween.doc
- Hallοween party invitation.doc
- Halloween Pot Luck 10.31.doc
- Halloween party.doc
If a user opened the attachment, they would see the typical “Enable Editing” and “Enable Content” buttons, which when clicked, install the Emotet Trojan on the computer. We hope you didn’t fall for the trap. You should never enable editing when receiving a document from an unknown sender.
According to Bleeping Computer, in this campaign too, Emotet retained the template that asked users to upgrade their installed version of Microsoft Word.
