Saturday, February 15, 2025
HomeComputer SecurityHackers Launching Weaponized Word Document to Push Emotet & Qakbot Malware

Hackers Launching Weaponized Word Document to Push Emotet & Qakbot Malware

Published on

SIEM as a Service

Follow Us on Google News

A new malspam campaign pushes Emotet banking malware along with Qakbot as the follow-up malware.

The Emotet is a banking trojan that has the capabilities to steal personal information such as the username and the passwords.

Security researcher Brad Duncan tracked the malspam campaign that pushes Emotet malware and Qakbot as the follow-up malware.

Emotet banking malware is continually spreading since 2017 and it is one of the costly banking trojans and currently it spreading via large spam campaign.

The infection starts with invoice Email, that urges the users to clear the outstanding due, the email contains a link, and it asks users to click on the link to complete the payment.

An attached link points to an XML document when the user clicks on the link it downloads an XML document with the .doc extension, if the victim has MSOffice then it open’s in the Microsoft Word by default.


Flow chart for recent Emotet malspam infections

“The downloaded XML document has macros that, if enabled, will infect the vulnerable Windows host with Emotet,” SANS said via blog post.

Emotet is an advanced modular banking Trojan, it acts as dropper as well as the downloader, once it infects the victim’s machine it intercepts the logs, and save outgoing network traffic via a web browser leading to sensitive data being compiled to access the victim’s bank accounts.

After the initial infection, the Emotet downloads the Qakbot malware and installs to the victim machine. Both the malware remains persistent through the registry.

when Qakbot executed, it copied itself to another directory and replaced the original file with a re-named calc.exe.

The Qakbot malware is capable of monitoring the browsing activities of the infected computer and logs all information related to finance-related websites.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Read:

US-CERT Alerts Powerful Emotet Banking Malware Attack on Government, Private and Public Sectors

A Scary Evolution & Alliance of TrickBot, Emotet and Ryuk Ransomware Attack

Beware !! Worlds Most Active Malware Emotet Launching New Campaign With Malicious Word and PDF Attachments

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Fake BSOD Attack Launched via Malicious Python Script

A peculiar malicious Python script has surfaced, employing an unusual and amusing anti-analysis trick...

SocGholish Malware Dropped from Hacked Web Pages using Weaponized ZIP Files

A recent wave of cyberattacks leveraging the SocGholish malware framework has been observed using...

Lazarus Group Targets Developers Worldwide with New Malware Tactic

North Korea's Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign...

North Korean IT Workers Penetrate Global Firms to Install System Backdoors

In a concerning escalation of cyber threats, North Korean IT operatives have infiltrated global...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Fake BSOD Attack Launched via Malicious Python Script

A peculiar malicious Python script has surfaced, employing an unusual and amusing anti-analysis trick...

SocGholish Malware Dropped from Hacked Web Pages using Weaponized ZIP Files

A recent wave of cyberattacks leveraging the SocGholish malware framework has been observed using...

Lazarus Group Targets Developers Worldwide with New Malware Tactic

North Korea's Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign...