www.bleepingcomputer.com
Open in
urlscan Pro
104.20.59.209
Public Scan
Submitted URL: https://t.co/ndevfPExbl
Effective URL: https://www.bleepingcomputer.com/news/security/emotet-now-spreads-via-fake-adobe-windows-app-installer-packages/
Submission: On December 02 via api from US — Scanned from DE
Effective URL: https://www.bleepingcomputer.com/news/security/emotet-now-spreads-via-fake-adobe-windows-app-installer-packages/
Submission: On December 02 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/emotet-now-spreads-via-fake-adobe-windows-app-installer-packages/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/emotet-now-spreads-via-fake-adobe-windows-app-installer-packages/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/emotet-now-spreads-via-fake-adobe-windows-app-installer-packages/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* FBI seized $2.3M from affiliate of REvil, Gandcrab ransomware gangs
* EwDoor botnet targets AT&T network edge devices at US firms
* Android banking malware infects 300,000 Google Play users
* Finland warns of Flubot malware heavily targeting Android users
* New malware hides as legit nginx process on e-commerce servers
* Planned Parenthood LA discloses data breach after ransomware attack
* Emotet now spreads via fake Adobe Windows App Installer packages
* Former Ubiquiti dev charged for trying to extort his employer
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Emotet now spreads via fake Adobe Windows App Installer packages
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
EMOTET NOW SPREADS VIA FAKE ADOBE WINDOWS APP INSTALLER PACKAGES
By
LAWRENCE ABRAMS
* December 1, 2021
* 06:43 PM
* 0
The Emotet malware is now distributed through malicious Windows App Installer
packages that pretend to be Adobe PDF software.
Emotet is a notorious malware infection that spreads through phishing emails and
malicious attachments. Once installed, it will steal victims' emails for other
spam campaigns and deploy malware, such as TrickBot and Qbot, which commonly
lead to ransomware attacks.
The threat actors behind Emotet are now infecting systems by installing
malicious packages using a built-in feature of Windows 10 and Windows 11 called
App Installer.
PLAY Top Articles Video Settings Full Screen About Connatix V140482 Read More
Read More Read More Read More Read More Planned Parenthood LA discloses data
breachafter ransomware attack 1/1 Skip Ad Continue watching after the ad Visit
Advertiser website GO TO PAGE
Researchers previously saw this same method being used to distribute the
BazarLoader malware where it installed malicious packages hosted on Microsoft
Azure.
ABUSING WINDOWS APP INSTALLER
Using URLs and email samples shared by the Emotet tracking group Cryptolaemus,
BleepingComputer demonstrates below the attack flow of the new phishing email
campaign.
This new Emotet campaign starts with stolen reply-chain emails that appear as a
reply to an existing conversation.
These replies simply tell the recipient to "Please see attached" and contain a
link to an alleged PDF related to the email conversation.
Emotet phishing email
Source: @malware_traffic
When the link is clicked, the user will be brought to a fake Google Drive page
that prompts them to click a button to preview the PDF document.
Phishing landing page prompting you to preview the PDF
Source: BleepingComputer
This 'Preview PDF' button is an ms-appinstaller URL that attempts to open an
appinstaller file hosted on Microsoft Azure using URLs at
*.web.core.windows.net.
For example, the above link would open an appinstaller package at the following
example URL:
ms-appinstaller:?source=https://xxx.z13.web.core.windows.net/abcdefghi.appinstaller.
An appinstaller file is simply an XML file containing information about the
signed publisher and the URL to the appbundle that will be installed.
An Emotet appinstaller XML file
Source: BleepingComputer
When attempting to open an .appinstaller file, the Windows browser will prompt
if you wish to open the Windows App Installer program to proceed.
Once you agree, you will be shown an App Installer window prompting you to
install the 'Adobe PDF Component.'
App Installer prompting to install the Fake Adobe PDF Component
Source: BleepingComputer
The malicious package looks like a legitimate Adobe application, as it has a
legitimate Adobe PDF icon, a valid certificate that marks it as a 'Trusted App',
and fake publisher information. This type of validation from Windows is more
than enough for many users to trust the application and install it.
Once a user clicks on the 'Install' button, App Installer will download and
install the malicious appxbundle hosted on Microsoft Azure. This appxbundle will
install a DLL in the %Temp% folder and execute it with rundll32.exe, as shown
below.
Installing the Emotet infection
Source: BleepingComputer
This process will also copy the DLL as a randomly named file and folder in
%LocalAppData%, as shown below.
Emotet saved under a random file name
Source: BleepingComputer
Finally, an autorun will be created under
HKCU\Software\Microsoft\Windows\CurrentVersion\Run to automatically launch the
DLL when a user logs into Windows.
Registry autorun to start Emotet when Windows starts
Source: BleepingComputer
Emotet was the most highly distributed malware in the past until a law
enforcement operation shut down and seized the botnet's infrastructure. Ten
months later, Emotet was resurrected as it started to rebuild with the help of
the TrickBot trojan.
A day later, Emotet spam campaigns began, with emails hitting users' mailboxes
with various lures and malicious documents that installed the malware.
These campaigns have allowed Emotet to build its presence rapidly, and once
again, perform large-scale phishing campaigns that install TrickBot and Qbot.
Emotet campaigns commonly lead to ransomware attacks. Windows admins must stay
on top of the malware distribution methods and train employees to spot Emotet
campaigns.
RELATED ARTICLES:
New Windows zero-day with public exploit lets you become an admin
Microsoft: Windows Installer breaks apps after updates, repairs
Microsoft increases Windows 11 rollout pace to Windows 10 devices
How to fix the Windows 0x0000007c network printing error
The new Microsoft Store is now rolling out to Windows 10 PCs
* App Installer
* Emotet
* Microsoft
* Phishing
* Windows 10
* Windows 11
* Facebook
* Twitter
* LinkedIn
* Email
*
LAWRENCE ABRAMS
Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com.
Lawrence's area of expertise includes Windows, malware removal, and computer
forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation,
Recovery, and Administration Field Guide and the technical editor for Rootkits
for Dummies.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Microsoft Defender scares admins with Emotet false positives
* DNA testing firm discloses data breach affecting 2.1 million people
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2021 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT