Retour 
Summary
Emotet is undoubtedly a very resilient botnet. Even though its operation was disrupted by Europol in January 2021, Emotet came back a few months later and continues to spread. In May 2022, shortly after Microsoft released new controls related to malicious macros, Netskope Threat Labs analyzed an Emotet campaign where they were testing a new delivery method, by using LNK files. Later, Netskope Threat Labs found a new campaign in June 2022 where Emotet continued to use Microsoft Office files to spread its payloads.
After another brief hiatus, a new Emotet campaign was spotted in March 2023, where attackers are still using Microsoft Office files as a delivery method. While there are also no notable differences in its main payload, the attackers behind Emotet have added a technique that increases the file size to bypass security solutions that do not scan large files. In this blog post, we will analyze this Emotet campaign from the delivery mechanism to the last payload.
Analysis
While Emotet continues to abuse Microsoft Office to deliver the second stage through malicious macros, attackers are now using a technique known as binary padding, where junk bytes are added at the end of the file to increase its size, to evade security solutions that do not scan large files.
This example Emotet sample contains many zero bytes at the end of the file, increasing its size to over 500 MB. To spread this file, the attackers are compressing the word document in a ZIP file and attaching it to spam emails.
Emotet continues to use the same Office template that it has used since 2021, luring users to bypass Microsoft Office controls to enable malicious macros.
As usual, Emotet contains multiple URLs to download the second stage, which are obfuscated within the malicious macros. The code iterates through this URL list and tries to download the file. If the URL is offline, then it moves to the next one until it finds an online payload.
Netskope Threat Labs found three online URLs delivering two distinct payloads. Emotet attackers are also using the binary padding technique in the second stage payloads. These files were likely compiled on March 8 and March 9, 2023.
Like previous campaigns analyzed by Netskope Threat Labs, Emotet continues to store its main payload, and the shellcode that runs the payload, encrypted as resources in the second stage PE file.
Once running, Emotet first decrypts the shellcode from the PE’s resources and then, using the same algorithm, decrypts its main payload to the process memory.
Once both resources are decrypted and a