Emotet Trojan Brings a Halloween Email Malware Scare

The Emotet Trojan celebrates Halloween by pushing out new spam templates to invite you to a local party. While these emails give you a treat, Emotet tricks you into an infection.

For those who do not know Emotet, it is a malware infection which is distributed over spam emails containing malicious documents. Such documents install the Emotet Trojan on the computer of the victim and download other malware to send more spam.

The Emotet Gang has modified its e-mail template in order to make use of new topics to invite you to a Halloween party.

We first heard from the Emotet monitoring team Cryptolaemus and Cofense Labs, an email security company who was kind enough to send some pictures of the new subject.

Click each image to see in full size

While the time and content of the various e-mails are slightly different, you are usually invited by the following text to a Halloween party:

Dear Neighbors and Friends,

It is Halloween and time for TREAT OR TRICK.

Please join us for a casual dinner party on Halloween night, Oct.31, 2019 starting at 6:00pm. Come and say hello to your neighbors and enjoy some food and drinks.

We are looking forward to a fun day and kindly respond with an email to make sure we have enough TREAT for you.

Details in the attachment.

Cofense told that the top email topics for this campaign are:

Party invitation
Halloween party invitation
Happy Halloween
Party tonight
Halloween party
Halloween Party
Halloween
Halloween invitation

That email includes a word document that pretends to have been invited by the Halloween party. The most widely used attachment names according to Cofense are:

Halloween party invitation.doc
Halloween party.doc
Happy Halloween.doc
Halloween.doc
Halloween invitation.doc
Halloween Party.doc
Party tonight.doc
Party invitation.doc

When a user opens the attachment, he is welcomed by the standard “Enable content” button, which installs the Trojan Emotet on the computer when he is clicked. Don’t open it, therefore:) Malicious folder

Malicious document

I must be honest, it was a bit disappointing, after opening the attachment, to find out that the document template did not change to invite an orange party and festive, but I don’t suppose you can have everything.

So if you receive an email inviting you to a Halloween party at the last minute, do not open your attachment, as it won’t be a pleasant experience to do.

Btw, is somebody else as interested as who is “The Michael?”