Emotet Returns, Now Adopts Binary Padding for Evasion

Summary:[emaillocker id="1283"]

In a prior incident, Zip files that were attached to emails included dangerous documents sent by the Emotet malware. Even though Microsoft will by default disable macros on the internet in 2022, the document template uses social engineering to fool users into activating macros, enabling the attack to proceed as planned. Researchers discovered that the malicious payloads delivered by the Emotet malware use a new approach called binary padding. Binary padding is used to increase file sizes above the thresholds set by anti-malware tools like sandboxes and scan engines.

To avoid security solutions, the threat actors behind these emails have used binary padding, in which both the dropper document and the Emotet DLL files are inflated to 500+ megabytes. When the malicious document's macros are enabled, it will download a ZIP file from hardcoded and obfuscated URLs. It will then determine whether the file is a PE file or a Zip file. Threat actors use file formats other than Zip files containing binary padded PE files. The macro employs a function to determine the file type of the downloaded payload. The contents of the Zip file are then extracted to the destination folder, and the temporary folder files are deleted. The Emotet dll is then loaded, and the Emotet payload is silently executed to infect the endpoint.

Execution Flow

Emotet has shown to be a powerful and persistent threat, even with its infrastructure destroyed. It wouldn't be surprising to see it continue to change in additional attacks, using new evasion strategies, other malware distribution mechanisms, and perhaps incorporating third-stage payloads into its routines.

Threat Profile:

References:

The following reports contain further technical details:

https://www.trendmicro.com/en_us/research/23/c/emotet-returns-now-adopts-binary-padding-for-evasion.html