Emotet Exposed: Insider the Cybercriminal's Supply Chain
summary
VMware researchers build a sock puppet Emotet client and study ~20,000 samples over six months, extracting 328 unique C2 IPs and 139 distinct execution trees, finding the core DLL always delivered alongside spam, mail‑password stealers, SMB lateral modules and a Chrome credit‑card stealer. They use conceptual hash to ignore noisy data sections, cluster C2s with TF‑IDF+DBSCAN into 13 campaigns, distinguish Epoch4/Epoch5 test vs deployment backends, and observe heavy use of port 8080 and stable JARM fingerprints indicating reused proxy infrastructure.
AI-written summary · about
chapters (7)
- 0:00Introduction to Emotet
- 1:08What is Emotet
- 8:51Emotet modules and infrastructure
- 18:40Execution evasion techniques
- 24:41Infrastructure lifecycle
- 43:16Key findings and conclusions
- 45:50Q&A session
related talks
54mAnalyzing Emotet infections
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
47mDetecting and analyzing files-less malware
35m"Inside Cybercrime Groups Harvesting Active Directory for Fun..."
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
42mKeynote: The Expanding Universe of Cyber Threats
56mCybersecurity & Privacy From The Global Lens