Binary Defense Emotes Wi-Fi Spreader

Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.

Emotet has leveraged the Admin$, C$, and IPC$ shares for lateral movement.

Emotet has dropped an embedded executable at `%Temp%\setup.exe`. Additionally, Emotet may embed entire code into other files.

Emotet has installed itself as a new service with the service name `Windows Defender System Service` and display name `WinDefService`.

Emotet has exfiltrated data over its C2 channel.

Emotet has used HTTP for command and control.

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Emotet has used `CreateProcess` to create a new process to run its executable and `WNetEnumResourceW` to enumerate non-hidden shares.

Emotet has been observed using a hard coded list of passwords to brute force user accounts.

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Emotet has used Google’s Protobufs to serialize data sent to and from the C2 server. Additionally, Emotet has used Base64 to encode data before sending to the C2 server.

Emotet has the ability to duplicate the user’s token. For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.

Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`.

Emotet has used a self-extracting RAR file to deliver modules to victims. Emotet has also extracted embedded executables from files using hard-coded buffer offsets.

Emotet has been observed creating new services to maintain persistence.

Emotet has copied itself to remote systems using the `service.exe` filename.

Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.

Emotet has reflectively loaded payloads into memory.