Emotet spam uses unconventional IP address formats to evade detection

Experts warn Emotet malware campaign using “unconventional” IP address formats in an attempt to evade detection.

Threat actors behind a recent Emotet malware campaign have been observed using using “unconventional” IP address formats to evade detection. Trend Micro researchers reported that threat actors are using hexadecimal and octal representations of the IP address.

“We observed Emotet spam campaigns using hexadecimal and octal representations of IP addresses, likely to evade detection via pattern matching. Both routines use social engineering techniques to trick users into enabling document macros and automate malware execution. Upon receiving these standards, operating systems (OS) automatically convert the values to the dotted decimal quad representation to initiate the request from the remote servers.” reported Trend Micro.

The attack chain is the same used in previous campaigns, treat actors distribute the malware through weaponized Excel documents using Excel 4.0 Macros, a dated feature used to automate repetitive tasks in the popular Office software.

Once tricked recipient in enabling document macros, the malicious code will contact a URL that’s obfuscated with carets (“h^tt^p^:/^/0xc12a24f5/cc.html”), with the host incorporating a hexadecimal representation of the IP address to execute an HTML application (HTA) code from a remote host under the control of the attackers:

Experts pointed out that once executed, the macro also invokes cmd.exe > mshta.exe with the URL as an argument to download and execute an HTA code from the remote host. This specific behavior could be used to detect the ongoing attack.

The researchers also spotted another variant of this malspam campaign that obfuscated the URL with carets but the IP contains an octal representation. Decoding the string “h^tt^p^:/^/0056.0151.0121.0114/c.html” into a dotted quad format we obtain 46[.]105[.]81[.]76.

“Moreover, the unconventional use of hexadecimal and octal IP addresses may result in evading current solutions reliant on pattern matching. But in the same vein, the unusual technique in the command lines can be used as a detection opportunity, with security teams using filters as leverage that can be enabled to treat such IP addresses as suspicious and associate them with malware.” concludes the report that also includes indicators of compromise for these attacks.

The Emotet banking trojan has been active at least since 2014, the botnet is operated by a threat actor tracked as TA542. The infamous banking trojan was also used to deliver other malicious code, such as Trickbot and QBot trojans, or ransomware such as Conti, ProLock, Ryuk, and Egregor.

In mid-November researchers from multiple cybersecurity firms ([Cryptolaemus], [GData], and [Advanced Intel]) reported that threat actors are using the TrickBot malware to drop an Emoted loader on infected devices. The experts tracked the campaign aimed at rebuilding the Emotet botnet using TrickBot’s infrastructure as Operation Reacharound.

In December, the Emotet malware was observed directly installing Cobalt Strike beacons to give the attackers access to the target network.

Researchers from AdvIntel believe that the return will have a significant impact on the ransomware operations in the threat landscape, likely “the largest threat ecosystem shift in 2021” and beyond due to three reasons:

1. Emotet’s unmatched continuous loader capabilities
2. The correlation between these capabilities and the demanded of the contemporary cybercrime market
3. The return of the TrickBot-Emotet-Ransomware triad resulted from the first two points.

The Emotet botnet was resurrected by its former operator, who was convinced by the Conti ransomware gang. The shutdown of the Emotet operation resulted in the lack of high-quality initial access brokers.

Qbot and TrickBot used Emotet’s service to deploy multiple ransomware strains, including Conti, DoppelPaymer, Egregor, ProLock, Ryuk, and others).

The vacuum left by Emotet shutdown urged its resurgence, for this reason, its return will have a major impact on the threat landscape.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Emotet)

[adrotate banner=”5″]

[adrotate banner=”13″]