National Cyber Awareness System Alerts Emotet Malware

Systems Affected


Network Systems
Overview


Emotet is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Emotet continues to be among the most costly and destructive malware affecting state, local, tribal, and territorial (SLTT) governments, and the private and public sectors.

This joint Technical Alert (TA) is the result of Multi-State Information Sharing & Analysis Center (MS-ISAC) analytic efforts, in coordination with the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC).
Description


Emotet continues to be among the most costly and destructive malware affecting SLTT governments. Its worm-like features result in rapidly spreading network-wide infection, which are difficult to combat. Emotet infections have cost SLTT governments up to $1 million per incident to remediate.

Emotet is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Additionally, Emotet is a polymorphic banking Trojan that can evade typical signature-based detection. It has several methods for maintaining persistence, including auto-start registry keys and services. It uses modular Dynamic Link Libraries (DLLs) to continuously evolve and update its capabilities. Furthermore, Emotet is Virtual Machine-aware and can generate false indicators if run in a virtual environment.

Emotet is disseminated through malspam (emails containing malicious attachments or links) that uses branding familiar to the recipient; it has even been spread using the MS-ISAC name. As of July 2018, the most recent campaigns imitate PayPal receipts, shipping notifications, or “past-due” invoices purportedly from MS-ISAC. Initial infection occurs when a user opens or clicks the malicious download link, PDF, or macro-enabled Microsoft Word document included in the malspam. Once downloaded, Emotet establishes persistence and attempts to propagate the local networks through incorporated spreader modules.


Figure 1: Malicious email distributing Emotet

Currently, Emotet uses five known spreader modules: NetPass.exe, WebBrowserPassView, Mail PassView, Outlook scraper, and a credential enumerator.
NetPass.exe is a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives.
Outlook scraper is a tool that scrapes names and email addresses from the victim’s Outlook accounts and uses that information to send out additional phishing emails from the compromised accounts.
WebBrowserPassView is a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module.
Mail PassView is a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo! Mail, and Gmail and passes them to the credential enumerator module.
Credential enumerator is a self-extracting RAR file containing two components: a bypass component and a service component. The bypass component is used for the enumeration of network resources and either finds writable share drives using Server Message Block (SMB) or tries to brute force user accounts, including the administrator account. Once an available system is found, Emotet writes the service component on the system, which writes Emotet onto the disk. Emotet’s access to SMB can result in the infection of entire domains (servers and clients).

Figure 2: Emotet infection process

To maintain persistence, Emotet injects code into explorer.exe and other running processes. It can also collect sensitive information, including system name, location, and operating system version, and connects to a remote command and control server (C2), usually through a generated 16-letter domain name that ends in “.eu.” Once Emotet establishes a connection with the C2, it reports a new infection, receives configuration data, downloads and runs files, receives instructions, and uploads data to the C2 server.

Emotet artifacts are typically found in arbitrary paths located off of the AppData\Local and AppData\Roaming directories. The artifacts usually mimic the names of known executables. Persistence is typically maintained through Scheduled Tasks or via registry keys. Additionally, Emotet creates randomly-named files in the system root directories that are run as Windows services. When executed, these services attempt to propagate the malware to adjacent systems via accessible administrative shares.

Note: it is essential that privileged accounts are not used to log in to compromised systems during remediation as this may accelerate the spread of the malware.


Example Filenames and Paths:

C:\Users\<username>\AppData \Local\Microsoft\Windows\shedaudio.exe

C:\Users\<username>\AppData\Roaming\Macromedia\Flash Player\macromedia\bin\flashplayer.exe

Typical Registry Keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

System Root Directories:

C:\Windows\11987416.exe

C:\Windows\System32\46615275.exe

C:\Windows\System32\shedaudio.exe

C:\Windows\SysWOW64\f9jwqSbS.exe
Impact


Negative consequences of Emotet infection include
temporary or permanent loss of sensitive or proprietary information,
disruption to regular operations,
financial losses incurred to restore systems and files, and
potential harm to an organization’s reputation.
Solution




NCCIC and MS-ISAC recommend that organizations adhere to the following general best practices to limit the effect of Emotet and similar malspam:
Use Group Policy Object to set a Windows Firewall rule to restrict inbound SMB communication between client systems. If using an alternative host-based intrusion prevention system (HIPS), consider implementing custom modifications for the control of client-to-client SMB communication. At a minimum, create a Group Policy Object that restricts inbound SMB connections to clients originating from clients.
Use antivirus programs, with automatic updates of signatures and software, on clients and servers.
Apply appropriate patches and updates immediately (after appropriate testing).
Implement filters at the email gateway to filter out emails with known malspam indicators, such as known malicious subject lines, and block suspicious IP addresses at the firewall.
If your organization does not have a policy regarding suspicious emails, consider creating one and specifying that all suspicious emails should be reported to the security or IT department.
Mark external emails with a banner denoting it is from an external source. This will assist users in detecting spoofed emails.
Provide employees training on social engineering and phishing. Urge employees not to open suspicious emails, click links contained in such emails, or post sensitive information online, and to never provide usernames, passwords, or personal information in answer to any unsolicited request. Educate users to hover over a link with their mouse to verify the destination prior to clicking on the link.
Consider blocking file attachments that are commonly associated with malware, such as .dll and .exe, and attachments that cannot be scanned by antivirus software, such as .zip files.
Adhere to the principle of least privilege, ensuring that users have the minimum level of access required to accomplish their duties. Limit administrative credentials to designated administrators.
Implement Domain-Based Message Authentication, Reporting & Conformance (DMARC), a validation system that minimizes spam emails by detecting email spoofing using Domain Name System (DNS) records and digital signatures.

If a user or organization believes they may be infected, NCCIC and MS-ISAC recommend running an antivirus scan on the system and taking action to isolate the infected workstation based on the results. If multiple workstations are infected, the following actions are recommended:
Identify, shutdown, and take the infected machines off the network;
Consider temporarily taking the network offline to perform identification, prevent reinfections, and stop the spread of the malware;
Do not log in to infected systems using domain or shared local administrator accounts;
Reimage the infected machine(s);
After reviewing systems for Emotet indicators, move clean systems to a containment virtual local area network that is segregated from the infected network;
Issue password resets for both domain and local credentials;
Because Emotet scrapes additional credentials, consider password resets for other applications that may have had stored credentials on the compromised machine(s);
Identify the infection source (patient zero); and
Review the log files and the Outlook mailbox rules associated with the infected user account to ensure further compromises have not occurred. It is possible that the Outlook account may now have rules to auto-forward all emails to an external email address, which could result in a data breach.
Reporting

MS-ISAC is the focal point for cyber threat prevention, protection, response, and recovery for the nation’s SLTT governments. More information about this topic, as well as 24/7 cybersecurity assistance for SLTT governments, is available by phone at 866-787-4722, by email at SOC@cisecurity.org, or on MS-ISAC’s website at https://msisac.cisecurity.org/.

To report an intrusion and request resources for incident response or technical assistance, contact NCCIC by email at NCCICCustomerService@hq.dhs.gov or by phone at 888-282-0870.

What is steganography? A complete guide to the ancient art of concealing messages Ben Dickson 06 February 2020

Hidden secrets laid bare



Steganography, the practice of hiding information, has been around for centuries. And in parallel to technological advances, steganography has also evolved and adapted with the advent of computers and the internet.

Digital steganography usually involves hiding data inside innocuous files such as images, videos, and audio.

Today, digital steganography is one of the important components in the toolboxes of spies and malicious hackers, as well as human rights activists and political dissidents.
What is steganography?

Steganography is the use of various methods to hide information from unwanted eyes. In ancient times, steganography was mostly done physically.

The oldest documented case of steganography dates to 500 BC, in which Histiaeus, the ruler of Milteus, tattooed a message on the shaved head of one of his slaves and let the hair grow back. He then sent the slave to the Aristagoras, his son-in-law, who shaved the slave’s head again and revealed the message.

In the centuries that followed, more modern forms of steganography were invented, such as invisible inks. Today, steganography has moved to the digital world.

“Steganography by definition is the hiding of one file within another,” says Ira Winkler, lead security principal at Trustwave.
How does steganography work?

Steganography works by hiding information in a way that doesn’t arouse suspicion. One of the most popular techniques is 'least significant bit (LSB) steganography. In this type of steganography, the information hider embeds the secret information in the least significant bits of a media file.

For instance, in an image file each pixel is comprised of three bytes of data corresponding to the colors red, green, and blue (some image formats allocate an additional fourth byte to transparency, or ‘alpha’).

LSB steganography changes the last bit of each of those bytes to hide one bit of data. So, to hide one megabyte of data using this method, you’ll need an eight-megabyte image file.

Since modifying the last bit of the pixel value doesn’t result in a visually perceptible change to the picture, a person viewing the original and the steganographically modified images won’t be able to tell the difference.




Steganography is the practice of hiding of one file within another




The same scheme can be applied to other digital media (audio and video), where data is hidden in parts of the file that result in the least change to the audible or visual output.

Another less popular steganography technique is the use of word or letter substitution. Here, the sender of the secret message hides the text by distributing it inside a much larger text, placing the words at specific intervals.

While this substitution method is easy to use, it may also make the text look strange and out of place, since the secret words might not fit particularly well into their target sentences.

There are other types of steganography, such as hiding an entire partition on a hard drive, or embedding data in the header section of files and network packets. The effectiveness of these methods depends on how much data they can hide and how easy they are to detect.
Who uses steganography?

Malicious hackers use steganography for a variety of tasks such as hiding malicious payloads and script files. Malware developers often use LSB steganography to hide the code for their malware in images of celebrities and famous songs and execute them with another program after the file is downloaded on the victim’s computer.

“The term ‘Trojan Horse’ is used to describe a dangerous file hidden within a harmless file. Macro attacks are a form of steganography as well,” Trustwave’s Winkler says.

“Steganography will be used by creative hackers whenever there is a need to bypass protections.”

Cybercriminals, however, are not the only actors who use steganography on a daily basis. Spies use the technique to communicate with their command center without arousing suspicion among their hosts.

Tech-savvy human rights activists and dissidents also use steganography when they want to send sensitive information.




Steganography is used by everyone from human rights activists to cybercriminals
Differences between steganography and cryptography

Steganography is often compared to cryptography. While steganography hides information, cryptography focuses on rendering the data unreadable to everyone except its intended recipient. Once a stream of data is encrypted, only a person who has access to its decryption key will be able to unlock it.

But if cryptography provides better protection for secret data, why use steganography at all?

The presence of cryptography reveals that something is hidden, and in many cases, this is enough to get the sender in trouble.

“In a highly monitored country, like say China or Iran or North Korea, cryptographic files can be detected and the very fact you are sending/receiving them could raise suspicion,” says security researcher John Ortiz.

“When they show up and put a gun to your head for the key, even the most secure crypto is worthless.”

Sometimes, steganography and cryptography are used together.

“Steganography and encryption are not actually mutually exclusive,” says Jerome Segura, director of threat intelligence at Malwarebytes. “The former is mainly a way to conceal data within an image file, but that data doesn’t have to be in clear text either.”

Segura and researchers at Malwarebytes have been recently investigating a case where attackers were using image-based steganography to hide encrypted data. Even if someone discovers the hidden data, they will still need to decrypt it to reveal its contents.
When do malicious hackers use steganography?

“Steganography, as any other obfuscation method, is a way the bad actor will use to keep their malicious code hidden for as long as possible,” says Fioravante Souza, threat research manager at Sucuri. “By embedding malicious code inside benign file types, the hackers increase their chances of getting past threat detection tools and security analysts.

“Such a stealth method makes it harder for security products to detect and protect against the threats that use them. Antivirus products do not usually scan for non-executable file headers (such as sound files, images),” says Ophir Harpaz, a security researcher at Guardicore.

In several cases, the attackers used steganography to hide their malware in images uploaded on social media networks and then used a local tool to download them onto the victims’ computers.

But the use of steganography in cyberattacks is not without its hurdles. “The key challenges with steganography in terms of malware or storing data is that the file size increases. For large amounts of data, it becomes easy to spot. But when it’s not, it becomes more troublesome to find,” says Cesar Anjos, an analyst at Sucuri.


Recent examples of steganography

Detecting steganography can be very tricky, but recent examples of steganography detected in malicious attacks include:
January 2020: Researchers at Malwarebytes reported credit card skimmer code hidden in image files in compromised e-commerce websites.
January 2020: Researchers at Guardicore Labs discovered a cryptominer that was hidden inside WAV audio files.
August 2019: Researchers at TrendMicro find a new variant of keylogger and cryptocurrency stealer malware LokiBot which uses steganography to hide its malicious code inside a jpeg file.
April 2019: a former GE engineer was charged with economic espionage. The employee had encrypted files containing GE’s proprietary information and hidden them in a photo of a sunset.
February 2019: researchers at ad fraud prevention firm Devcon discovered a malvertising campaign using steganography to hide malicious JavaScript code.
December 2018: Malicious actors used steganography to hide malicious code in Twitter memes.
Last updated: February 2020


How to detect steganography

The practice of detecting steganography is called ‘steganalysis’. There are several tools that can detect the presence of hidden data such as StegExpose and StegAlyze. Some analysts use other general analysis tools such as hex viewers to detect anomalies in files.

Finding files that have been modified through steganography continues to remain a challenge, however. For instance, knowing where to start looking for hidden data in the millions of images being uploaded on social media every day is virtually impossible.

“The data looks like/sounds like noise, so it is difficult to distinguish from the existing noise. Or it is in very little data,” Ortiz says. “And there are so many different hiding techniques that you need multiple detection techniques to detect them – there is no one-size-fits-all”

Guardicore’s Harpaz warns: “Threat actors have a decent arsenal of steganography techniques they use as part of their modus operandi – it is not a new trend. As our research shows, it remains in the wild to this day and is not likely to disappear.”

Adposhel adware takes over browser push notifications administration

ADWARE
Adposhel adware takes over browser push notifications administration

Posted: February 6, 2020 by Pieter Arntz


Since late last year, our researchers have been monitoring new methods being deployed by cybercriminals to potentially abuse browser push notifications. Now, an adware family detected by Malwarebytes as Adware.Adposhel is doing just that, taking control of push notifications in Chrome at the administrator level.
What does Adposhel adware do?

The adware uses Chrome policies to ensure that notification prompts will be shown to users ands add some of its own domains to the list of sites that are allowed to push browser notifications. So far nothing new. The recent twist, however, is that Adposhel enforces these settings as an administrator, meaning a regular Chrome user will not be able to change the settings in the notifications menu.

It seems the adware family has now decided to fully deploy this tactic, as we are seeing complaints about it emerging on forums, such as Reddit.

Victims have complained about being unable to remove domains from the list of domains that are allowed to show push notifications, and being unable to change the setting that control whether websites can ask you to allow notifications.

Disabling that setting would stop a user from seeing prompts like these:


If a user were to click Allow on that prompt, this domain would be added to their allowed list of URLs, with the understanding that it could be removed manually in the notifications menu.

Adposhel uses the NotificationsAllowedForUrls policy to block users from removing their entries from the Allow list.

Where you would normally see the three dots (ellipsis) menu icon representing the settings menu, entries submitted to a policy by Adposhel will see an icon telling you the setting is enforced by an administrator.


If you hover over the icon, the accompanying text confirms it.

How do I undo the changes made by Adposhel adware?

This does not mean that you can change that setting just because you are the administrator of the system you are working on, by the way. But if you are the system administrator, you can fix the notification changes made by the Adposhel installer by applying a simple registry fix:Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome] "DefaultNotificationsSetting"=dword:00000001 [-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\NotificationsAllowedForUrls]


This is safe to do unless there were legitimate URLs in the list of URLs that were allowed to show notifications by policy, which I doubt. But we always advise to create a backup of the registry before making any changes.

Backing up Registry with ERUNT

Modifying the registry may create unforeseen results, so we always recommend creating a backup prior to doing that.

Please download ERUNT and save the file to the desktop.
Install ERUNT by following the prompts, but say No to the portion that asks you to add ERUNT to the startup folder.
Right-click on the icon and select Run as Administrator to start the tool.
Leave the default location (C:\WINDOWS\ERDNT) as a place for your backup.
Make sure that System registry and Current user registry are ticked.
The third option Other open users registries is optional.
Press OK to backup and then press YES to create the folder.

This tool won’t generate a report. You may uninstall it after you’re done cleaning.
Protection and detection

Malwarebytes detects the installers as Adware.Adposhel.


The URLs enforced by this Adpohel-induced Chrome policy are detected as Adware.ForcedNotifications.ChrPRST.
IOCs

Domains:aclassigned.info chainthorn.com cityskyscraper.com concreasun.info dimlitroom.com durington.info efishedo.info enclosely.info insupposity.info nineteducer.info oncreasun.info parliery.info qareaste.info stilysee.info suggedin.info


Stay safe, everyone!

Free software download sites can be dangerous.

Free software download sites can be dangerous. Visiting a bad site could end up with you smothered in fake download buttons and fake virus and malware warnings, which are usually malware in disguise.


A good internet security suite can protect you against malware-loaded downloads, but it’s better to avoid such free download sites altogether. Stick to tried-and-true sites that are committed to being free of malware and deception.

In addition to personal experience, we used these tools for check website reputations and build our list of the best software download sites:

Web of Trust
URLVoid

In order for a website to qualify for this list, it had to score at least 90% with Web of Trust and 35/36 with URLVoid. No site can ever be 100% safe, but these download sites are generally clean and worthwhile.
1. Ninite



WOT Trustworthiness: 94%
URLVoid Rating: 36/36


For those who don’t know about Ninite, it’s quite simple: the website presents you with a list of programs that you can select, then lets you download a custom installer file that bundles all of the selected programs together so you can install them in bulk.How To Install & Uninstall Windows Programs In Bulk How To Install & Uninstall Windows Programs In BulkA mass installer or uninstaller can save you heaps of time. Remember the last time you set up a new computer? We are going to teach you how to do these tasks in a flash.READ MORE

Ninite is known for its safety and security, so you don’t have to worry about malware or bundled bloatware and junkware. Run the same installer file at a later time and Ninite will automatically update every program.

This is a great tool to download the best Windows software.The Best PC Software for Your Windows Computer The Best PC Software for Your Windows ComputerWant the best PC software for your Windows computer? Our massive list collects the best and safest programs for all needs.READ MORE
2. Softpedia




WOT Trustworthiness: 93%
URLVoid Rating: 36/36

Softpedia is arguably the largest file host on the web, complete with over 850,000 files in its database. Hundreds of them are updated every single day, so not only can you get clean and malware-free programs, but you can be sure that they are as recent as possible.7 Types of Computer Viruses to Watch Out For and What They Do 7 Types of Computer Viruses to Watch Out For and What They DoMany types of computer viruses can steal or destroy your data. Here are some of the most common viruses and what they do.READ MORE

On top of that, it has a fantastic reputation and an easy-to-use interface that makes it painless to browse for programs and drivers of all types—whether on Windows, Mac, Linux, Android, iOS, or Windows Mobile.
3. MajorGeeks




WOT Trustworthiness: 93%
URLVoid Rating: 36/36

Even though the site looks like it’s straight out of the 90s, MajorGeeks has been one of the most reputable software download sites for over 15 years. When a site has a couple thousand users online at any given time, you know it’s providing a great service.

Its list of Top Freeware Picks is a great place to start, but don’t be afraid to browse the left sidebar and look through all kinds of highly-rated programs that you might find handy.
4. FileHippo




WOT Trustworthiness: 93%
URLVoid Rating: 36/36

FileHippo is a well-known site with over 20,000 active programs broken down into 16 helpful categories across Windows, Mac, and Web. But whatever you do, if the site offers you a download manager or anything like that, skip it and go for the direct download instead.

One thing to note is that FileHippo offers an Update Checker program, which scans your system and compares all current programs to see if any of them need to be updated. It’s the easiest way to make sure all of your software is consistently up-to-date.
5. DonationCoder



WOT Trustworthiness: 92%
URLVoid Rating: 36/36

We recently highlighted Donation Coder when we included Automatic Screenshotter in our coverage of free screen recorders for Windows. As you might glean from its name, Donation Coder prides itself on providing free and clean software in exchange for nothing but donations.3 Free Screen Recorders to Capture Your Windows Desktop 3 Free Screen Recorders to Capture Your Windows DesktopYou can use a screen recorder to create tutorials, document bugs for troubleshooting, or track unsolicited activity on your desktop in your absence. Choose from one of our recommended tools.READ MORE

The downside to this site is that you’ll only find utilities created by Donation Coder, so the repository is small and niche. Then again, a lot of the programs are quite useful and interesting, so maybe you’ll find something that catches your eye.
6. Download Crew



WOT Trustworthiness: 91%
URLVoid Rating: 36/36

Despite its cluttered and headache-inducing website, Download Crew is worth using because each listed program has a short but informative review that explains what it does, why it’s good, and what flaws it has.

Want to find some cool new programs? Start with the “Most Popular Downloads” section and the “Editor’s Choice” section (which you can access at the bottom of the home page). Programs are available for Windows, Mac, Linux, Android, and iOS.
7. FileHorse



WOT Trustworthiness: 91%
URLVoid Rating: 36/36

FileHorse doesn’t have a massive repository of software. Instead, this site focuses on only stocking the best and most useful programs and making sure all of them are clean and free of malware and viruses. It’s great for finding popular alternatives to popular programs.
8. FilePuma



WOT Trustworthiness: 90%
URLVoid Rating: 36/36

FilePuma and the aforementioned FileHippo share a lot of similarities—and I’m not just talking about their names. Where FilePuma excels is in its categorization, which is much easier to browse than FileHippo.

FilePuma also has its own Update Detector program to keep your software up to date. Very handy if FileHippo’s tool doesn’t work well for you or if you don’t like it for some other reason.
9. SnapFiles



WOT Trustworthiness: 90%
URLVoid Rating: 36/36

There’s little to differentiate SnapFiles from other free software download sites, but if there’s one thing I like about this one, it’s the “Daily Freeware Pick” that’s highlighted on the home page. If you check in every day, you can occasionally find some really useful tools and utilities.
Where Do You Download Free Software?

Don’t just rely on this list! At the end of the day, staying safe on the Web involves practicing good security habits, such as checking the integrity of files you download with suitable hash checkers. In particular, you should heed these common-sense tips for avoiding malware.

And if you ever slip up and find that your computer has been compromised, follow our guide to cleaning up malware and viruses from your system.10 Steps To Take When You Discover Malware On Your Computer 10 Steps To Take When You Discover Malware On Your ComputerWe would like to think that the Internet is a safe place to spend our time (cough), but we all know there are risks around every corner. Email, social media, malicious websites that have worked...READ MORE

If you also own a Mac, be sure to see our best sites to download secure Mac apps.