New Emotet trojan variant uses different POST-infection traffic to infect users

• The malware variant is tracked as Trojan.W97M.POWLOAD and spreads via phishing emails.
• The email contains a malicious ZIP file, which if opened, results in the download of the malware.

A new variant of Emotet trojan that leverages a new POST-infection traffic technique has been discovered recently. The malware variant is tracked as Trojan.W97M.POWLOAD and spreads via phishing emails.

How does it propagate - According to researchers from Trend Micro, the new sample spreads via spam email with the help of the trojan downloader Powload. The email contains a malicious ZIP file, which if opened, results in the download of the malware. In order to open the file, the victims are required to provide the 4-digit password which is included in the email.

What’s the change in POST-infection traffic - Unlike the previous version, the new variant uses random words and numbers as a URI directory path in order to evade detection.

“Apart from the URI path, the data in the HTTP POST message body has also changed. Previous Emotet samples typically used an HTTP GET request to send victim information to the C&C server, and the data is stored in the Cookie header. The data was encrypted using an RSA key, AES, and then encoded in Base64 before being added to the Cookie value,” the researchers explained.

Worth noting - An investigation of open ports and services reveals that this new variant of Emotet is using vulnerable internet-connected devices as the first layer of C2 server. The vulnerable devices include routers, IP cameras, web servers and more.

“This first layer serves as a proxy that redirects victims to the real Emotet C&C servers, adding another layer of complexity in C&C server communication to make it more difficult to track down the actors behind the Emotet operations. Moreover, compromising vulnerable devices gives them additional resources that they can use for other malicious purposes,” the researchers noted.