A message from malware writers to ESET found in Emotet

[Marcos 5,742]

 

[Nightowl 206]

On 11/21/2019 at 10:18 AM, Marcos said:

 

This is interesting to be honest, wondering what is the message behind this.

Is it stupid because they can bypass easily?

Or is it stupid because they can't bypass easily?

Or they simply sending challenge messages to Malware Analyzers

[Marcos 5,742]

They wouldn't bother sending messages to lame analysts who would not be able to find the message at all Obviously it's because our detection and protection is hard or impossible to bypass.

[Nightowl 206]

9 minutes ago, Marcos said:

They wouldn't bother sending messages to lame analysts who would not be able to find the message at all Obviously it's because our detection and protection is hard or impossible to bypass.

This is great , but in the same time it will add more challenge to ESET , because they might try their best to break the defense/protection.

Edited November 24, 2019 by Rami

[itman 1,924]

The malware code comment can be interpreted two ways.

The first is as commented upon in this thread. That is the malware author has issues with bypassing Eset's protections. The second interpretation is the opposite. The malware author has no issues bypassing Eset.

Without clarification from the malware author, it is impossible to determine what he meant by the code comment.

[BALTAGY 32]

@Marcos pls check this one, since i can't download it to send it via ESET
https://www.virustotal.com/gui/file/5d178be58d8588c9b7460343f6c8a6fa8d0fd554df6450ab0beec905052371a0/detection

[itman 1,924]

1 hour ago, BALTAGY said:

@Marcos pls check this one, since i can't download it to send it via ESET
https://www.virustotal.com/gui/file/5d178be58d8588c9b7460343f6c8a6fa8d0fd554df6450ab0beec905052371a0/detection

Looks like someone is trying to impersonate equi.exe. Detailed analysis here: https://www.hybrid-analysis.com/sample/5d178be58d8588c9b7460343f6c8a6fa8d0fd554df6450ab0beec905052371a0?environmentId=100

Interesting that Eset doesn't detect it.

Edited November 24, 2019 by itman

[BALTAGY 32]

13 minutes ago, itman said:

Looks like someone is trying to impersonate equi.exe. Detailed analysis here: https://www.hybrid-analysis.com/sample/5d178be58d8588c9b7460343f6c8a6fa8d0fd554df6450ab0beec905052371a0?environmentId=100

Interesting that Eset doesn't detect it.

Ya, sadly i can't download it to see if it will run while ESET installed

[itman 1,924]

2 minutes ago, BALTAGY said:

Ya, sadly i can't download it to see if it will run while ESET installed

It's definitely ransomware.

[BALTAGY 32]

6 minutes ago, itman said:

It's definitely ransomware.

Yes it's WannaCash
https://twitter.com/thyrex2002/status/1198543193266106368

[itman 1,924]

Note that to drop an .exe to C:\ in Win 10, you need full admin privileges.

So either a UAC bypass was deployed or user is tricked into manually elevating.

[Nightowl 206]

13 hours ago, itman said:

Note that to drop an .exe to C:\ in Win 10, you need full admin privileges.

So either a UAC bypass was deployed or user is tricked into manually elevating.

What about PowerShell scripts that elevate admin privileges without Windows/AV understanding what is happening behind the scene? , could that be used for the ransomware?

[itman 1,924]

4 hours ago, Rami said:

What about PowerShell scripts that elevate admin privileges without Windows/AV understanding what is happening behind the scene? , could that be used for the ransomware?

Actually these use a Windows "living of the land" trusted executable to perform hidden privilege escalation.

This ransomware variant to date has been delivered via e-mail archived attachment. So macro use is a definite possibility. As far as I am concerned, anyone that has not by now permanently disabled Office macros deserves to get nailed by malware.

[Hpoonis 7]

I gave up running MSOffice, primarily because of 'clicktorun'. It just rubbed me up the wrong way but have never enabled macros.

The small things...Outlook no longer marks emails as read if they are selected after a time.  That option has been removed.

I decided to stick with LibreOffice. I am just a bit miffed that most organisations with any web presence will only accept doc(x), xls(x), etc and not also .odf.

Edited November 25, 2019 by Hpoonis

[Nightowl 206]

23 hours ago, Hpoonis said:

I gave up running MSOffice, primarily because of 'clicktorun'. It just rubbed me up the wrong way but have never enabled macros.

The small things...Outlook no longer marks emails as read if they are selected after a time.  That option has been removed.

I decided to stick with LibreOffice. I am just a bit miffed that most organisations with any web presence will only accept doc(x), xls(x), etc and not also .odf.

I stick also with LibreOffice but the trouble is that when you have someone that only wants Microsoft Office , I have also disabled Macros in Office , so it would be a little bit more safer.