Emotet and Trickbot Banking Trojans Acquire Internet Worm Capabilities
This means the malware will now self-replicate
Emotet and TrickBOT are two, relatively recent banking Trojans that have shot up in popularity in the past couple of years.
Recently, researchers discovered that two have developed a new kind of malicious feature, directly inspired by the success of the WannaCry and Petya ransomware.
The pair now comes with self-replicating capabilities, which mimic the behavior of Internet worms.
Here’s a quick look into how banking Trojans work ...
Banking Trojans and financial malware, in general, seek to steal a user’s money by quietly infiltrating his device while posing as a legitimate program and stealing his banking credentials.
The most straightforward method is to harvest the data using a keylogger, which records what users type into forms, or even what they copy/paste into it. The more advanced keyloggers will stay dormant, and only activate when visiting a certain website, or completing certain forms.
Other methods include redirects, where the banking Trojan will modify a user’s browser settings so they will be constantly redirected from the legitimate banking website to a copied one that looks identical. Basically, if you type in the address of Site A, the banking Trojan will instead send you to Site B, which is the phishing website.
Once they have your login details, all they have to do is clean-up bank and leave you penniless.
How Internet worms work
The most successful malware out there (such as ransomware or banking Trojans) don’t actually spread from user to user. Instead, they rely on a central infection point, such as a malicious website designed to infect visitors. A more effective method, however, is to simply spam the user with phishing emails that tempt him to download the malware.
An Internet worm works differently. It seeks to exploit weaknesses in software or websites, so one user can infect the other without the participation of the malicious hacker.
One of the most famous cases is that of the Samy MySpace worm. It took the name of its creator, Samy Kamkar, then a 19-year old hacker, who wanted to impress his buddies with how many friends he had on MySpace.
So he made a script, where every profile visitor sent a friend request. On top of that, the script also modified the profile of the visitor to include the line “but most of all, Samy is my hero”, and link to Samy’s MySpace.
Initially, he hoped to gather 200 to 300 friends over a 6 month period. However, within 20 hours, he received 1 million friend requests.
While not designed for profit, the Samy worm remains a textbook case of an Internet worm.
Worm functionalities in Emotet and TrickBOT
The malware is initially distributed using phishing emails disguised as invoices from financial companies.
Emotet will first scan a network for accessible IPC$ drives. IPC is short for inter-communication protocol and is an important technology in managing communications between servers and computers connected to it.
Emotet will then attempt to take control of a computer by launching a brute force attack against the account login details.
A brute force attack is a password guessing method, where the attacker tries countless password variations in the hope of finding the correct one and opening up the account.
Emotet first targets normal user accounts, such as “NetUserEnum”. If the login attempt fails, it then targets the device’s administrator account.
Here is a list of passwords used in a brute-force attack:
See all compromised passwords
If the brute force attack is successful and Emotet gains access to the computer, it will then copy itself from the attacking device onto the newly infected one.
In Trickbot’s case, researchers at Intel have discovered that malware creators are testing a new type of functionality that seems to exploit weaknesses in SMB (short for Server Message Block). This might sound familiar to you since it is the same kind of exploit used by WannaCry and Petya.
Fortunately, these new functionalities for Trickbot aren’t yet active in the wild, so users are mostly safe. For now.
Just like with Emotet, malicious hackers first spread Trickbot by way of spam and phishing emails, often disguised as invoices.
Source
If the infection is successful, Trickbot will then use the SMB exploit to scan for other computers connected in a network. Once it finds new targets, Trickbot will infect them via LDAP (short for lightweight access protocol).
How to stay safe from Trickbot and Emotet
Update your Windows software
Both WannaCry and Petya ransomware were possible because of a vulnerability in Windows SMB called EternalBlue. Microsoft has released an update that fixes it but most users have yet to install it. Here are the steps you should follow to manually update your PC.
Set up a strong password to protect your account
Setting up a good, strong password is one of the most heavily repeated cybersecurity advice coming from professionals.
Password guessing methods such as brute-force or dictionary attacks can guess your average, 6 character password in 5 seconds. In comparison, a 14 character password requires 5,000 years of hacking attempts to break open.
Here are some basic tips you can follow to set up a strong password:
Make it at least 10 characters long
Include an upper and lower case letter, a number and a special character (such as “ or *)
Never reuse the same password for more than 2 accounts.
Always log out from accounts when you’ve finished using them.
Use a password manager.
If you want a more in-depth view of password security, we suggest you visit our dedicated security guide on the subject.
Companies are most exposed to worm-like malware
Most companies have their own network of computers and servers, and all communicate with one another. Internet worms leverage this exact type of setup. Shared drives, Dropbox and other file-sharing techniques are all excellent targets.
This means the malware will now self-replicate
Emotet and TrickBOT are two, relatively recent banking Trojans that have shot up in popularity in the past couple of years.
Recently, researchers discovered that two have developed a new kind of malicious feature, directly inspired by the success of the WannaCry and Petya ransomware.
The pair now comes with self-replicating capabilities, which mimic the behavior of Internet worms.
Here’s a quick look into how banking Trojans work ...
Banking Trojans and financial malware, in general, seek to steal a user’s money by quietly infiltrating his device while posing as a legitimate program and stealing his banking credentials.
The most straightforward method is to harvest the data using a keylogger, which records what users type into forms, or even what they copy/paste into it. The more advanced keyloggers will stay dormant, and only activate when visiting a certain website, or completing certain forms.
Other methods include redirects, where the banking Trojan will modify a user’s browser settings so they will be constantly redirected from the legitimate banking website to a copied one that looks identical. Basically, if you type in the address of Site A, the banking Trojan will instead send you to Site B, which is the phishing website.
Once they have your login details, all they have to do is clean-up bank and leave you penniless.
How Internet worms work
The most successful malware out there (such as ransomware or banking Trojans) don’t actually spread from user to user. Instead, they rely on a central infection point, such as a malicious website designed to infect visitors. A more effective method, however, is to simply spam the user with phishing emails that tempt him to download the malware.
An Internet worm works differently. It seeks to exploit weaknesses in software or websites, so one user can infect the other without the participation of the malicious hacker.
One of the most famous cases is that of the Samy MySpace worm. It took the name of its creator, Samy Kamkar, then a 19-year old hacker, who wanted to impress his buddies with how many friends he had on MySpace.
So he made a script, where every profile visitor sent a friend request. On top of that, the script also modified the profile of the visitor to include the line “but most of all, Samy is my hero”, and link to Samy’s MySpace.
Initially, he hoped to gather 200 to 300 friends over a 6 month period. However, within 20 hours, he received 1 million friend requests.
While not designed for profit, the Samy worm remains a textbook case of an Internet worm.
Worm functionalities in Emotet and TrickBOT
The malware is initially distributed using phishing emails disguised as invoices from financial companies.
Emotet will first scan a network for accessible IPC$ drives. IPC is short for inter-communication protocol and is an important technology in managing communications between servers and computers connected to it.
Emotet will then attempt to take control of a computer by launching a brute force attack against the account login details.
A brute force attack is a password guessing method, where the attacker tries countless password variations in the hope of finding the correct one and opening up the account.
Emotet first targets normal user accounts, such as “NetUserEnum”. If the login attempt fails, it then targets the device’s administrator account.
Here is a list of passwords used in a brute-force attack:
See all compromised passwords
If the brute force attack is successful and Emotet gains access to the computer, it will then copy itself from the attacking device onto the newly infected one.
In Trickbot’s case, researchers at Intel have discovered that malware creators are testing a new type of functionality that seems to exploit weaknesses in SMB (short for Server Message Block). This might sound familiar to you since it is the same kind of exploit used by WannaCry and Petya.
Fortunately, these new functionalities for Trickbot aren’t yet active in the wild, so users are mostly safe. For now.
Just like with Emotet, malicious hackers first spread Trickbot by way of spam and phishing emails, often disguised as invoices.
Source
If the infection is successful, Trickbot will then use the SMB exploit to scan for other computers connected in a network. Once it finds new targets, Trickbot will infect them via LDAP (short for lightweight access protocol).
How to stay safe from Trickbot and Emotet
Update your Windows software
Both WannaCry and Petya ransomware were possible because of a vulnerability in Windows SMB called EternalBlue. Microsoft has released an update that fixes it but most users have yet to install it. Here are the steps you should follow to manually update your PC.
Quote:(FIRST INSTALL GUARDEDID, THEN CHANGE YOUR PASSWORDS !!! Otherwise, you just gave them your new password)
Set up a strong password to protect your account
Setting up a good, strong password is one of the most heavily repeated cybersecurity advice coming from professionals.
Password guessing methods such as brute-force or dictionary attacks can guess your average, 6 character password in 5 seconds. In comparison, a 14 character password requires 5,000 years of hacking attempts to break open.
Here are some basic tips you can follow to set up a strong password:
Make it at least 10 characters long
Include an upper and lower case letter, a number and a special character (such as “ or *)
Never reuse the same password for more than 2 accounts.
Always log out from accounts when you’ve finished using them.
Use a password manager.
If you want a more in-depth view of password security, we suggest you visit our dedicated security guide on the subject.
Companies are most exposed to worm-like malware
Most companies have their own network of computers and servers, and all communicate with one another. Internet worms leverage this exact type of setup. Shared drives, Dropbox and other file-sharing techniques are all excellent targets.
1
1
