EMOTET Dynamic Configuration Extraction
ID: a8b4cc2e-2f8b-5cd4-baed-8752798049cf
STIX ID: report--a8b4cc2e-2f8b-5cd4-baed-8752798049cf
Feed Name: Elastic Security Labs
Threat Score
Elastic Security analyzes changes in 64-bit EMOTET samples that moved configuration, ECC keys, C2 addresses and strings from static blobs into runtime-calculated, obfuscated code. The report documents identification methods (YARA signatures), static analysis and dynamic emulation techniques (SMDA, Unicorn) to extract keys, C2 lists and decoded strings, and publishes an open-source EMOTET configuration extractor to assist defenders in recovering indicators and tracking campaigns.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.