Tuesday, May 13, 2025
HomeComputer SecurityNew Wave of Emotet Malware Hacks Wi-Fi Networks to Attack New Victims

New Wave of Emotet Malware Hacks Wi-Fi Networks to Attack New Victims

Published on

SIEM as a Service

Follow Us on Google News

A new wave of Emotet malware campaign With New Wi-Fi Spreader takes advantage of the wlanAPI interface to enumerate all Wi-Fi networks in the area and spreads the infection.

The Emotet is a banking Trojan detected in the year 2014, it was designed to steal sensitive and private information.

It is one of the most dangerous malware and it is capable of delivering payloads based on the specific tasks. It’s warm like capability helps to spread rapidly with other connected computers.

- Advertisement - Google News

Malware Infection

Emotet primarily distributed through social engineering techniques such as the emails with the links to download the malware.

With the new Emotet campaign it arrives with a new Wi-Fi Spreader module downloads to the system C:\ProgramData. The downloaded binary contains a self-extracting RAR that has two (service.exe and worm.exe) binaries to spread the infection through WiFi.

Emotet wifi
Worm file Download

The worm.exe is the executable used for spreading the malware, once it executed it copies the service.exe to a variable for using it while spreading.

Then it calls wlanAPI.dll class that used by Native Wi-Fi to manage the wireless network profiles and connections for spreading the infection to other networks.

Emotet wifi
Emotet Wifi Distribution

“The Worm enumerates all Wi-Fi devices currently enabled on the local computer, which it returns in a series of structures. These structures contain all the information relating to the Wi-Fi device, including the device’s GUID and description,” read the Binary Defense analysis.

It gathers possible information from every available Wi-Fi network present in the list of networks.

Breaking Weak Wi-Fi Network

Once the connection established with the Wi-Fi network it enumerates users and attempts brute-force for all users on the network.

Next, the Service.exe is the payload installed by worm.exe on the machine, once installed it communicates with the C2 server and executes the binary embedded in service.exe.

Previously Emotet known to distributed only through malspam and infected networks, with this new loader it spreads through nearby wireless networks that use weak passwords.

IOCs

9.file            865cf5724137fa74bd34dd1928459110385af65ffa63b3734e18d09065c0fb36
Worm.exe 077eadce8fa6fc925b3f9bdab5940c14c20d9ce50d8a2f0be08f3071ea493de8
Service.exe 64909f9f44b02b6a4620cdb177373abb229624f34f402335ecdb4d7c8b58520b
Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Apple Releases Security Patches to Fix Critical Data Exposure Flaws

Apple released critical security updates for macOS Sequoia 15.5 on May 12, 2025, addressing...

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...