{"id":16528,"date":"2020-11-01T01:00:38","date_gmt":"2020-11-01T00:00:38","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=16528"},"modified":"2020-11-01T01:00:38","modified_gmt":"2020-11-01T00:00:38","slug":"emotet-malware-als-vermeintliches-word-update-getarnt","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2020\/11\/01\/emotet-malware-als-vermeintliches-word-update-getarnt\/","title":{"rendered":"Emotet malware comes as a supposed Word update"},"content":{"rendered":"

[German<\/a>]A brief warning: The criminals behind the emotet malware are now distributing this malware via a mail attachment that appears as a supposed Word update. Microsoft warns about that. <\/p>\n

<\/p>\n

\"\"Emotet<\/a> is a family of malware that is spread via e-mail and is usually contained in Word documents with malicious macros. When these documents are opened, their content attempts to trick the user into activating macros, so that the Emotet malware is downloaded and installed on the computer. The malware can deliver a variety of malicious functions, most often infecting ransomware to encrypt the data along with a ransom demand. The sender of these mails is often known contacts of the recipient, as Emotet uses the contact lists on infected systems to send the mail. <\/p>\n

Emotet  disguised as a Word update<\/h2>\n

The cyber criminals of the Emotet group have been changing their strategy for spreading malware for a week now and are distributing a new message with an attachment claiming to be from Microsoft. The message states that Microsoft Word must be updated to add a new feature. <\/p>\n

\"Emotet-Malware<\/a><\/p>\n

This is pointed out by the above tweet<\/a> from Bleeping Computer, among others. The backers use a lottopics in their mail, to lure victims, as explained in this article<\/a>. This ranges from supposed information about COVID-19 to alleged orders, alleged invoices and applications. And lately just alleged Word updates. On Twitter, Microsoft has posted examples of such mails in this tweet<\/a> (here<\/a> on Halloween), but also the following screenshot.   <\/p>\n

\"Emotet<\/p>\n

The attachment is a Word document that contains a malicious macro. In the mail the user is asked to upgrade Microsoft Word and links request to release document editing (Enable Editiing is supposed to enable macro editing) and upgrade (Enable Content loads the macro). When the macro is activated and executed, it connects to a malicious domain to download the emotet payload. I have warned about emotet on this blog many times, as this malware is one of the most successful blackmail Trojans currently active.<\/p>\n

SImilar articles:
<\/strong>EmoCrash protectet systems for 6 months against emotet-infections<\/a>
Cryptolaemus and the fight against Emotet<\/a>
Warning about a new Emotet-Ransomeware campaign (Sept. 2020)<\/a>
Microsoft warns of massive Emotet campaign<\/a>
Emotet Trojan can overload computers on the network<\/a>
Emotet C&C servers deliver new malware<\/a>
FAQ: Responding to an Emotet infection<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

[German]A brief warning: The criminals behind the emotet malware are now distributing this malware via a mail attachment that appears as a supposed Word update. Microsoft warns about that.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580],"tags":[69],"class_list":["post-16528","post","type-post","status-publish","format-standard","hentry","category-security","tag-security"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/16528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=16528"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/16528\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=16528"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=16528"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=16528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}