Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Emotet Command and Control Case Study

Summary: Unit 42 published a step-by-step technical analysis of how the updated Emotet malware builds and encrypts its command-and-control data, using Microsoft's CryptoAPI to generate a machine identifier from GetComputerNameA and GetVolumeInformationW, collect OS and process data, and encrypt the payload with CryptEncrypt before exfiltrating it over HTTP via HttpSendRequestW. The report notes Emotet was active in the wild for several years before a coordinated law enforcement campaign shut down its infrastructure in late January 2021, and that its mature attack chain makes it a useful case study.

What's compelling: Emotet's C2 routine stitches together a machine ID, OS version, session and process data, then wraps it in an exported key, a 20-byte hash and encrypted payload sent as an application/octet-stream MIME attachment - traffic shaped to look like ordinary web form posts, which is why signature-only detection struggles against it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Endpoint & Network Security
Related