Banking Malware EMOTET and Trickbot Go Phishing... Again

Two banking Trojans resurged in a span of five days: EMOTET and Trickbot, detected by Trend Micro as TSPY_EMOTET and TSPY_TRICKLOAD, respectively. These banking malware are distributed through socially engineered malicious spam and phishing emails. Security researchers also noted the capabilities and techniques used, including its worm-like propagation, dropping additional malware into the affected machine, and mimicking the banks’ domains. 

EMOTET first emerged in 2014 targeting customers of German banks. Unlike other banking malware that employed malicious field insertions/phishing pages to steal banking information, EMOTET was capable of “sniffing” the data sent over network connections. This feature allowed attackers to bypass secure connections like HTTPS and evade traditional detection techniques. In December 2016, Trend Micro observed its reappearance in the same region, along with old but familiar information stealers DRIDEX and ZeuS/ZBOT. 

The latest resurgence of EMOTET also entailed dropping DRIDEX as additional payload. Malicious links in the spam email will redirect would-be victims into a domain hosting a Word document embedded with Visual Basic code that triggers a PowerShell script. This script will download and execute EMOTET and other payloads, the most common of which is DRIDEX, from various attacker-owned domains. 

[From TrendLabs Security Intelligence Blog: How EMOTET steals data through network sniffing] 

Trickbot is a banking Trojan that sends users banking-related website pages that almost look like the real thing. An iteration of older malware DYRE/Dyreza, Trickbot is also distributed via malicious spam containing HTML attachments. These HTML files download a Word document masquerading as a login form. It’s actually embedded with a malicious macro that retrieves Trickbot from the cybercriminals’ command and control (C&C) server when enabled. 

Trickbot’s operators have been observed actively pushing the malware through various spam email campaigns. The first campaigns this year were observed last April and July, targeting financial institutions and their customers in the US, UK, Australia, Switzerland, and Germany. 

[InfoSec Guide: Mitigating Email-based Threats] 

The mobile platform is also not immune. Android banking malware Bankbot (ANDROIDOS_BANKERSMS.OPS) resurfaced early this year, initially targeting Russian users via third-party app marketplaces. Now, it has more than 420 financial institutions in its list of targets, including those in Austria, France, Austria, the Netherlands, and Turkey. Bankbot was built from the source code of another banking Trojan that was leaked and fine-tuned by Bankbot’s operators. 

This Android malware isn't just capable of stealing banking credentials and credit card data information; it also monitors and intercepts text messages, which enables the bad guys to bypass verification methods like two-factor authentication. It's also capable of mining credit card data stored in apps installed on the device, like Facebook, WhatsApp, Google Play, and Uber. In mid-April and late July this year, several Bankbot-infected apps made their way into Google Play, posing as video or online banking apps. The said apps have since been taken down. 

[READ: What hackers can do with your stolen identity] 

The spate of campaigns that deliver information stealers reflect how hackers value personally identifiable information. This is especially true for financial data, as these can be used not only for emptying bank accounts, but also as tradeable commodities in the cybercriminal underground. In 2016, fraud and identity theft have cost businesses and end users over US $16 billion in losses. 

While these threats still rely on old tactics such as the use of macros and spam messages, they are compounded with techniques that provide stealth. Case in point: the increasing use of vectors that aren’t typically used to deliver malware, such as HTML files or legitimate system administration tools like PowerShell. EMOTET and Trickbot’s self-replication capability also seems to draw inspiration from the notorious WannaCry and Petya outbreaks. 

How can enterprises and end-users avoid or defend against these threats? Follow best practices for defending against phishing attacks. An attacker has a lot to gain with just a single typo. Identify the tell-tale signs of malware gone phishing: the sender’s name, email address, URL/domain, grammar and spelling errors, unsolicited request for personal information. Employ strong security policies to your organization’s email gateway and ensure that your network infrastructure can filter, validate, and block malicious traffic like anomalous data exfiltration.