modified: 2024-11-25T16:00:51.198Z
name: Emotet
description: [Emotet](https://attack.mitre.org/software/S0367) is a modular malware variant which is primarily used as a downloader for other malware variants such as [TrickBot](https://attack.mitre.org/software/S0266) and [IcedID](https://attack.mitre.org/software/S0483). Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.(Citation: Trend Micro Banking Malware Jan 2019)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.7
x_mitre_contributors: Omkar Gudhate
x_mitre_aliases: Emotet
Geodo
type: malware
spec_version: 2.1
id: malware--32066e94-3112-48ca-b9eb-ba2b59d2f023
created: 2019-03-25T18:35:14.353Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0367
external_id: S0367
source_name: Emotet
description: (Citation: Trend Micro Banking Malware Jan 2019)(Citation: Kaspersky Emotet Jan 2019)(Citation: CIS Emotet Apr 2017)(Citation: Malwarebytes Emotet Dec 2017)(Citation: Symantec Emotet Jul 2018)(Citation: US-CERT Emotet Jul 2018)(Citation: ESET Emotet Nov 2018)(Citation: Secureworks Emotet Nov 2018)(Citation: Talos Emotet Jan 2019)(Citation: Trend Micro Emotet Jan 2019)(Citation: CIS Emotet Dec 2018)(Citation: Picus Emotet Dec 2018)(Citation: Red Canary Emotet Feb 2019) 
source_name: Geodo
description: (Citation: Trend Micro Emotet Jan 2019)
source_name: Talos Emotet Jan 2019
description: Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.
url: https://blog.talosintelligence.com/2019/01/return-of-emotet.html
source_name: CIS Emotet Apr 2017
description: CIS. (2017, April 28). Emotet Changes TTPs and Arrives in United States. Retrieved January 17, 2019.
url: https://www.cisecurity.org/blog/emotet-changes-ttp-and-arrives-in-united-states/
source_name: CIS Emotet Dec 2018
description: CIS. (2018, December 12). MS-ISAC Security Primer- Emotet. Retrieved March 25, 2019.
url: https://www.cisecurity.org/white-papers/ms-isac-security-primer-emotet/
source_name: Red Canary Emotet Feb 2019
description: Donohue, B.. (2019, February 13). https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/. Retrieved March 25, 2019.
url: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
source_name: ESET Emotet Nov 2018
description: ESET . (2018, November 9). Emotet launches major new spam campaign. Retrieved March 25, 2019.
url: https://www.welivesecurity.com/2018/11/09/emotet-launches-major-new-spam-campaign/
source_name: Secureworks Emotet Nov 2018
description: Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.
url: https://www.secureworks.com/blog/lazy-passwords-become-rocket-fuel-for-emotet-smb-spreader
source_name: Picus Emotet Dec 2018
description: Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.
url: https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html
source_name: Trend Micro Banking Malware Jan 2019
description: Salvio, J.. (2014, June 27). New Banking Malware Uses Network Sniffing for Data Theft. Retrieved March 25, 2019.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/
source_name: Kaspersky Emotet Jan 2019
description: Shulmin, A. . (2015, April 9). The Banking Trojan Emotet: Detailed Analysis. Retrieved March 25, 2019.
url: https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/
source_name: Malwarebytes Emotet Dec 2017
description: Smith, A.. (2017, December 22). Protect your network from Emotet Trojan with Malwarebytes Endpoint Security. Retrieved January 17, 2019.
url: https://support.malwarebytes.com/docs/DOC-2295
source_name: Symantec Emotet Jul 2018
description: Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.
url: https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor
source_name: Trend Micro Emotet Jan 2019
description: Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.
url: https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf
source_name: US-CERT Emotet Jul 2018
description: US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.
url: https://www.us-cert.gov/ncas/alerts/TA18-201A
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5