What is Emotet Malware?

Emotet Malware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Global banking and enterprise networks; self-propagating loader

Source Attribution

Origin: MITRE
Source: CISA · Europol takedown announcements
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA · Europol takedown announcements · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2014-06 discovered Emotet first observed as banking trojan
2021-01 updated Global coordinated takedown disrupted botnet clusters

Quick Answer

Emotet spreads via malicious email attachments and self-propagates through network shares; modules include spam, credential theft and loader functionality.

Definition

Emotet is a modular banking trojan turned botnet whose primary function is loading other malware (TrickBot, QakBot, ransomware) and sending spam.

Overview

Emotet is a modular banking trojan turned botnet whose primary function is loading other malware (TrickBot, QakBot, ransomware) and sending spam.

Behavior

Self-propagating via email and SMB
Module loader for other malware
Large-scale botnet takedowns

First Seen

2014-06

Target

Global banking and enterprise networks; self-propagating loader

Techniques: T1566, T1027, T1071.001
Campaigns: n/a
Related CVEs: n/a

Malware Intelligence

Family: Emotet Malware

Aliases: Emotet, Geodo, Maldoc

Techniques: T1566, T1027, T1071.001

Targets: Global banking and enterprise networks; self-propagating loader

Behavior:

Self-propagating via email and SMB
Module loader for other malware
Large-scale botnet takedowns

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Emotet Malware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Emotet Malware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.