Emotet: How to Best Protect Yourself Against This Trojan Horse | Antivirus Software

 

What is spyware?

Emotet is a malicious computer program originally developed in the form of a Trojan horse targeting banking data. Its goal was to gain access to foreign devices and spy on their sensitive private data. Emotet is famous for not being detected by and misleading basic antivirus programs. Once the computer is infected, the malware spreads like a computer worm and attempts to infiltrate other computers on the network.

Emotet is mainly spread via spam emails. If you download the document or click the link, another malware will automatically download to your computer. These emails were created to appear completely genuine and many have fallen into Emotet's trap.

Emotet: presentation

Emotet was first detected in 2014 when German and Austrian bank customers were targeted by the Trojan horse. Emotet managed to access customer identification data. The virus spread around the world over the following years.

From a Trojan horse targeting bank data, Emotet has become a dropper, meaning the Trojan loads malware onto devices. It is these programs that are responsible for the damage we know on systems.

In most cases, the following programs have been "dropped":

Trickster (also known as TrickLoader and TrickBot): Trojan horse targeting bank data that attempts to access bank account credentials.

Ryuk: Encryption Trojan, also known as Cryptotrojan or Ransomware, encrypts data and thus prevents the user from accessing it or accessing the entire system.

The goal of cybercriminals using Emotet is often to extort funds from their victims. For example, they threaten to publish the encrypted data to which they have access.

Who are Emotet's targets?

Emotet targets individuals, as well as businesses, organizations, and authorities. In 2018, after being infected with Emotet, the Fuerstenfeldbruck hospital in Germany had to shut down 450 computers and disconnect from the emergency control center in an attempt to control the infection. In September 2019, the Berlin Court of Appeal was affected. In December of the same year, the University of Giessen was targeted. The Hanover medical school and the Frankfurt city hall were also targeted by Emotet.

These infections are just a few examples among many. It is estimated that the number of businesses affected is much higher. It is also assumed that many infected companies did not want to report their infection for fear of damaging their reputation.

Let us also keep in mind that in its beginnings, Emotet mainly targeted companies and organizations, while the Trojan horse today mainly targets individuals.

What devices are exposed to Emotet?

Initially, Emotet infections were only detected on the most recent versions of the Microsoft Windows operating system. However, at the start of 2019, it became clear that Apple computers were also being targeted. Cybercriminals trick users with a fraudulent email supposedly from Apple Support. The email tells the user that the company will "restrict access to their account" if they don't respond. Victims are then asked to click on a link to allegedly avoid the deactivation and deletion of their Apple services.

How does the Emotet trojan spread?

Emotet is mainly spread through a so-called Outlook collection. The Trojan reads emails from already affected users and creates deceptive content. These emails appear legitimate and personalized, setting themselves apart from the usual spam. Emotet sends these phishing emails to saved contacts like friends, family members, and coworkers.

Usually, the emails contain a dangerous link or an infected Word document that the recipient is supposed to download. The sender's name is still correct. Everything suggests to the recipient that the email is legitimate. The victim (most of the time) clicks on the unsafe link or downloads the infected attachment.

Once Emotet has access to the network, it can spread quietly. As part of his process, he tries to find the account access passwords using the brute force method. Other means of Emotet's spread are the EternalBlue and DoublePulsar vulnerabilities on Windows, which allow malware to be installed without human intervention. In 2017, the WannaCry extortion trojan successfully exploited the EternalBlue vulnerability to carry out a major cyberattack with massive damage.

Who is behind Emotet?

“  Emotet developers sublet their software and infrastructure to third parties  ”.

They also rely on additional malware to achieve their goals. The BSI believes that the motivations of cybercriminals are financial and considers these types of attacks to be cybercrime, not espionage. Yet no one seems to know exactly who is behind Emotet. Several rumors circulate concerning the countries of origin, but nothing has been proven.

How dangerous is Emotet?

The US Department of Homeland Security came to the conclusion that Emotet was particularly expensive software with phenomenal destructive power. The cost of the cleanup is estimated at nearly $ 1 million per incident. BSI Director Arne Schoenbohm calls Emotet “the king of malware”.

Emotet is arguably the most complex and dangerous malware in the history of cybercrime. The virus is polymorphic, which means that its code changes slightly each time it is accessed.

This makes it difficult for antivirus software to identify it because many of them perform signature-based searches. In February 2020, Binary Search researchers discovered that Emotet was now attacking wifi networks. If an infected device is connected to a wifi network, Emotet analyzes all wifi networks located nearby. Using a list of passwords, the virus then attempts to access networks and infect other devices.

Cybercriminals play on the fears of the population. It is therefore hardly surprising that the panic linked to the coronavirus, which has raged around the world since December 2019, is also being exploited by Emotet. Cybercriminals using the Trojan create fraudulent emails supposedly informing the public about the coronavirus. If you find such an email in your inbox, pay attention to the attachments and links it contains.

How can I protect myself?

Protection against Emotet and other Trojans cannot be the responsibility of anti-virus programs alone. Detecting the polymorphic virus is only the first step for end users. There is virtually no solution that offers 100% protection against Emotet and the other constantly evolving Trojans. Only technical and organizational measures can minimize the risk of infection.

Here are some tips to protect yourself against Emotet:

Stay up to date: Keep yourself regularly informed of any news about Emotet. There are several options available to you, such as consulting the resource center or doing your own research.

Security updates: it is essential to install the updates provided by the manufacturers as quickly as possible to overcome any security vulnerabilities. This applies to operating systems like Windows and macOS, as well as all application programs, browsers, browser add-ons, email clients, Office systems, and PDF programs.

Antivirus protection: Install a comprehensive antivirus and antimalware program like Internet Security, and use it to regularly scan your computer for vulnerabilities. Such a program will give you optimal protection against the latest viruses, spyware, etc.

Do not download suspicious email attachments or click on suspicious links. If unsure about an email, don't take any chances and contact the sender. If you are prompted to allow a macro or downloaded file to run, do not do so under any circumstances and immediately delete the file. This way, you won't give Emotet a chance to access your computer.

Regularly back up your data to an external storage device. In the event of an infection, you will always have a backup that you can resort to and will not lose all the data on your device.

Use only strong passwords for all your identifiers (online banking, online stores mailbox). This means that you should avoid using your first dog's name, but rather a set of letters, numbers, and special characters. You can update them yourself or generate them using different programs. In addition, many programs today offer a two-factor authentication function.

File extensions: Let your computer display file extensions by default. This allows you to detect suspicious files like “Photo123.jpg.exe” which may be malware.

How to remove Emotet?

First of all, don't panic if you suspect that your computer has been infected with Emotet. Let your personal circle know because your email contacts are potentially exposed.

Next, be sure to isolate your computer if it is connected to a network to limit the risk of Emotet spreading. Finally, modify all the connection data for all your accounts (email accounts, web browsers, etc.). Use another device that is not infected or not connected to the same network to do this.

Emotet being polymorphic (which means that its code changes slightly each time it is accessed), a clean computer can be quickly re-infected if it is reconnected to an infected network. Therefore, you need to clean up all the computers connected to your network, one after another. Use an antivirus program to help you with this task. You can also contact a specialist, such as your anti-virus software vendor, for advice and assistance.

EmoCheck: is this tool really effective against Emotet?

The Japanese Computer Emergency Response Team has released a tool called EmoCheck, which is supposed to check if your computer has been infected with Emotet. But Emotet being polymorphic, EmoCheck can not guarantee 100% that your computer is healthy.

On the other hand, the tool detects typical character strings and informs you in the event of a potential Trojan horse. That said, the mutability of the virus does not guarantee that your computer is actually healthy. It is good to keep this in mind.

Conclusion

The Emotet Trojan is truly one of the most dangerous malware programs in cybersecurity history. Individuals, companies, or international authorities, everyone can be targeted. The Trojan that once infected a system reloads other malware that spies on you.

A large number of Emotet victims have received emails asking them to pay ransoms in exchange for their data. Unfortunately, no solution provides complete protection against infection with Emotet. However, there are several things you can do to limit the risk of infection.

If you suspect that your computer is infected with Emotet, take the steps mentioned in this article to clean up your computer and make sure that you are protected with a full antivirus software solution like Protegent360 malware protection solutions.