Attack Chain Overview: Emotet in December 2020 and January 2021
Summary: Unit 42 analyzed an Emotet update active in the wild since December 2020, tracing its full chain from a macro-enabled Word lure through a deobfuscated PowerShell loader to a third-stage DLL named R43H.dll. The malware decrypts 110,591 bytes of resource data with a 1-byte XOR loop, runs the result in memory, and installs a randomly named service to start itself, before sending data to its C2 server via HttpSendRequestW().
Bottom line: The chain is built to defeat single-point defenses: caret-escaped command strings, base64 PowerShell, a 37,652-byte length check, and an in-memory executable that never touches disk as a file. Coordinated law enforcement shut Emotet's infrastructure down in late January 2021, but the TTPs in this sample are the ones defenders will see again.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026