Emotet

First seen

2014-06-01 00:00:00

Malware type

botnet, downloader, trojan

Family

Malware family

Operating systems

windows

Related IoCs

78856 (59306 malicious)

Last IoC activity

2026-10-18 04:20:52

Profile updated

2026-07-07 12:38:31

Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical education-and-nonprofits technology-and-telecommunications

Context

Emotet is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID. Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.

Recent IoC activity

59,307 malicious indicators in Maltiverse are attributed to Emotet (S0367). The 20 most recently updated:

Detection coverage

• 9 YARA rules
• 831 Sigma rules

Malware & tools used

• System Owner/User Discovery (attack-pattern)
• Lateral Tool Transfer (attack-pattern)
• Symmetric Cryptography (attack-pattern)
• Credentials In Files (attack-pattern)
• Password Guessing (attack-pattern)
• Windows Management Instrumentation (attack-pattern)
• Non-Standard Port (attack-pattern)
• Binary Padding (attack-pattern)
• Regsvr32 (attack-pattern)
• SMB/Windows Admin Shares (attack-pattern)
• Malicious File (attack-pattern)
• Token Impersonation/Theft (attack-pattern)
• Local Accounts (attack-pattern)
• Registry Run Keys / Startup Folder (attack-pattern)
• Spearphishing Link (attack-pattern)
• Standard Encoding (attack-pattern)
• Network Share Discovery (attack-pattern)
• Web Protocols (attack-pattern)
• Exfiltration Over C2 Channel (attack-pattern)
• Embedded Payloads (attack-pattern)
• Ingress Tool Transfer (attack-pattern)
• Exploitation of Remote Services (attack-pattern)
• Email Collection (attack-pattern)
• Scheduled Task (attack-pattern)
• Credentials from Web Browsers (attack-pattern)

Used by threat actors

• Wizard Spider (threat-actor)

Detection rules

• TRELLIX_ARC_MALW_Emotet (yara-rule)
• CAPE_Emotetloader (yara-rule)
• CAPE_Emotetpacker (yara-rule)
• ARKBIRD_SOLG_MAL_Emotet_Nov_2021_1 (yara-rule)
• SIGNATURE_BASE_MAL_Emotet_JS_Dropper_Oct19_1 (yara-rule)
• SIGNATURE_BASE_MAL_Emotet_Jan20_1 (yara-rule)
• SIGNATURE_BASE_MAL_Emotet_BKA_Quarantine_Apr21 (yara-rule)
• SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21 (yara-rule)
• EMBEERESEARCH_Win_Emotet_String_Patterns_Oct_2022 (yara-rule)

Reports & references

• pwc.co.uk — Cyber Threats 2019 Retrospect (report)
• CISA — Aa22 110A (report)
• Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
• advintel.io — Advintel S State Of Emotet Aka Spmtools Displays Over Million Compromised Machines Through 2022 (report)
• blog.bushidotoken.net — Lessons From Conti Leaks (report)
• blog.reversinglabs.com — Conversinglabs Ep 2 Conti Pivots As Ransomware As A Service Struggles (report)
• content.secureworks.com — Secureworks Eco1 Threatintelligenceexecutivereport2022Vol2.Ashx (report)
• intel471.com — Conti Emotet Ransomware Conti Leaks (report)
• krebsonsecurity.com — Conti Ransomware Group Diaries Part Ii The Office (report)
• cert.ssi.gouv.fr — Certfr 2021 Cti 006 (report)
• dragos.com — Suspected Conti Ransomware Activity In The Auto Manufacturing Sector (report)
• secureworks.com — Gold Ulrick Leaks Reveal Organizational Structure And Relationships (report)
• Trend Micro — Cyberattacks Are Prominent In The Russia Ukraine Conflict (report)
• Broadcom/Symantec — Ransomware Hive Conti Avoslocker (report)
• checkpoint.com — March 2022S Most Wanted Malware Easter Phishing Scams Help Emotet Assert Its Dominance (report)
• spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
• marcoramilli.com — C2 Traffic Patterns Personal Notes (report)
• CISA — Aa22 110A Joint Csa Russian State Sponsored And Criminal Cyber Threats To Critical Infrastructure 4 20 22 Final (report)
• resource.redcanary.com — 2021 Threat Detection Report (report)
• CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
• threatconnect.com — Research Roundup Activity On Previously Identified Apt33 Domains (report)
• pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
• strapi.eurepoc.eu — Eu Repo C Apt Profile Conti Wizard Spider Dc2A733E18 (report)
• CrowdStrike — Meet Crowdstrikes Adversary Of The Month For February Mummy Spider (report)
• proofpoint.com — Threat Actor Profile Ta542 Banker Malware Distribution Service (report)

External references

• mitre-attack — S0367
• Emotet
• Geodo
• Talos Emotet Jan 2019
• CIS Emotet Apr 2017
• CIS Emotet Dec 2018
• Red Canary Emotet Feb 2019
• ESET Emotet Nov 2018
• Secureworks Emotet Nov 2018
• Picus Emotet Dec 2018
• Trend Micro Banking Malware Jan 2019
• Kaspersky Emotet Jan 2019
• Malwarebytes Emotet Dec 2017
• Symantec Emotet Jul 2018
• Trend Micro Emotet Jan 2019
• US-CERT Emotet Jul 2018
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy