Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader
Popular downloader malware highlights the dangers of using easy-to-guess passwords By: Mike McLellan, Director of Intelligence, Counter Threat Unit Research TeamAs featured in the 2018 State of Cybercrime Report released this week by Secureworks®, a small list of cybercrime malware is making the greatest impact in today's threat landscape, including — but not exclusively limited to — malware families like Emotet.
Emotet is a modular downloader, deployed by financially motivated criminals to steal credentials, collect email addresses for use in spam campaigns, use a compromised host as a proxy or spam server, and install other payloads on the networks of unsuspecting organizations.
One of the most dangerous capabilities that any downloader malware can have is the ability to propagate automatically to infect additional hosts within a network. If it can do that, it can increase the number of computers that have payloads delivered to them, causing victims greater disruption, higher cost, and increased difficulty in containing infections.
In mid-2018, analysis by Secureworks Counter Threat Unit® (CTU®) researchers of one particular Emotet module explained how the malware was able to spread rapidly in some networks, but barely at all in others. The secret, it turned out, was a hardcoded list of passwords.
Is Your Password on this List?
Using this module, Emotet would attempt to spread automatically to other systems using Microsoft's Server Message Block (SMB) protocol. When challenged for a password it would attempt to guess the correct answer by iterating through a list of common passwords hardcoded into the module. The list, provided below for your reading pleasure, included basic numerical combinations ('123456789'), common names ('andrew'), popular cultural figures ('spiderman'), sports teams ('steelers'), and some colloquial terms that are far less acceptable in print… For those readers who are offended by inappropriate language: you have been warned!
The malware only had to guess correctly once in order to infect the new computer, install itself as a service for persistence and attempt to spread to additional computers from there. The difference for organizations between having a password policy that forced users to have difficult- to- guess passwords versus having a weak password policy or no password policy at all was, in the case of Emotet, measured in terms of hundreds of infected computers, dozens of hours of incident response and tens or even hundreds of thousands of dollars.
Proper credential management is a key recommendation that Secureworks incident responders find themselves often making in the aftermath of a breach. The experience of dealing with Emotet shows that it will be time well spent. We always recommend that clients adopt a policy that forces users to create passwords that they can remember, but that are hard to guess. (Combinations of words might work better for your employees than randomized 15 character alpha-numeric strings with special characters.) It's also important to use technical controls and user education to reduce the potential for password re-use, and to remind users that using their first name or their preferred swear word is probably making things a little too easy for the criminal. (Table 1 is case in point!)
*TABLE 1 – Emotet Password List
This list contains some passwords using explicit language, and those items have been redacted because they may be offensive to some readers. If you would like to check whether your password is on the actual list, you may access the unredacted list here.
|
0000 |
alison |
cool |
hobbes |
naughty |
shannon |
|
00000 |
allison |
cooper |
hockey |
ncc1701 |
sharon |
|
000000 |
alpha |
copper |
homer |
ncc1701d |
shelby |
|
00000000 |
alyssa |
corvette |
honda |
nelson |
|
|
007007 |
amanda |
cougar |
|
nemesis |
|
|
01011980 |
america |
courtney |
|
newport |
shorty |
|
01012011 |
american |
cowboy |
|
newyork |
Sierra |
|
010203 |
anderson |
cowboys |
horses |
nicholas |
Silver |
|
098765 |
andre |
crazy |
hotdog |
nicole |
Simon |
|
0987654321 |
andrea |
creative |
hotrod |
|
Simple |
|
101010 |
andrew |
cricket |
house |
nikita |
Simpson |
|
102030 |
andrey |
crystal |
houston |
nintendo |
Simpsons |
|
1111 |
angel |
|
howard |
nirvana |
Skipper |
|
11111 |
angela |
|
hummer |
nissan |
Skippy |
|
111111 |
angels |
daddy |
hunter |
norman |
Skyline |
|
1111111 |
animal |
dakota |
iceman |
nothing |
Slayer |
|
11111111 |
anthony |
dallas |
iloveyou |
november |
Slipknot |
|
1111111111 |
antonio |
dancer |
indian |
october |
|
|
111222 |
apollo |
danger |
infinity |
oksana |
Smith |
|
112233 |
apple |
daniel |
internet |
oliver |
Smokey |
|
11223344 |
apples |
danielle |
ireland |
olivia |
Smooth |
|
1212 |
arizona |
darkness |
ironman |
online |
Snickers |
|
121212 |
arnold |
darkside |
iwantu |
orange |
Sniper |
|
12121212 |
arsenal |
dave |
jack |
ou812 |
Snoopy |
|
12312 |
arthur |
david |
|
packers |
Snowball |
|
123123 |
asd123 |
death |
jackie |
pakistan |
Soccer |
|
123123123 |
asdasd |
debbie |
jackson |
pamela |
Softball |
|
123123a |
asdf |
december |
jaguar |
pantera |
Sophie |
|
1232323q |
asdf1234 |
denise |
jake |
panther |
Spanky |
|
123321 |
asdfasdf |
dennis |
james |
panthers |
Sparky |
|
1234 |
asdfg |
denver |
jasmine |
panties |
Speedy |
|
12341234 |
asdfgh |
destiny |
jason |
paradise |
Spencer |
|
12344321 |
asdfghjk |
dexter |
jasper |
parker |
Spider |
|
12345 |
asdfghjkl |
diablo |
jeffrey |
pass |
Spiderma |
|
1234554321 |
ashley |
diamond |
jennifer |
passion |
Spiderman |
|
123456 |
|
|
jeremy |
passport |
Spirit |
|
1234567 |
|
|
jessica |
passw0rd |
Spitfire |
|
12345678 |
august |
diesel |
jessie |
password |
Spooky |
|
123456789 |
austin |
digger |
jester |
password1 |
Spring |
|
1234567890 |
avalon |
digital |
jesus |
patches |
Stalker |
|
123456789a |
avatar |
disney |
jimmy |
patricia |
Stanley |
|
123456789q |
awesome |
doctor |
john |
patrick |
Star |
|
123456a |
azerty |
doggie |
johnny |
patriots |
Stargate |
|
123456q |
baby |
dolphin |
johnson |
paul |
Startrek |
|
12345a |
babygirl |
dolphins |
jonathan |
peaches |
Starwars |
|
12345q |
badass |
domino |
jordan |
peanut |
Steelers |
|
12345qwert |
badboy |
donald |
jordan23 |
pearljam |
Stella |
|
1234qwer |
badger |
donkey |
joseph |
peekaboo |
stephen |
|
123654 |
bailey |
douglas |
joshua |
penguin |
steve |
|
123654789 |
bambam |
dragon |
junior |
|
steven |
|
123789 |
banana |
dreamer |
jupiter |
people |
stinky |
|
123abc |
bandit |
dreams |
justice |
pepper |
stupid |
|
123qwe |
barbara |
driver |
justin |
peter |
sublime |
|
12qwaszx |
barney |
drowssap |
juventus |
phantom |
success |
|
1313 |
baseball |
drummer |
karina |
phoenix |
sucker |
|
131313 |
|
ducati |
kawasaki |
phpbb |
|
|
134679 |
batman |
duncan |
kelly |
picard |
|
|
141414 |
baxter |
eagle |
kermit |
pimpin |
summer |
|
147147 |
bear |
eagle1 |
kevin |
pirate |
sunshine |
|
147258 |
beatles |
eagles |
killer |
platinum |
super |
|
147258369 |
beaver |
eclipse |
kimberly |
playboy |
superman |
|
147852 |
beavis |
edward |
king |
player |
surfer |
|
147852369 |
beer |
einstein |
kirill |
please |
suzuki |
|
151515 |
benjamin |
electric |
kitten |
pokemon |
svetlana |
|
159357 |
bigboy |
elephant |
kitty |
police |
sweet |
|
159753 |
|
elizabet |
klaster |
polina |
swordfis |
|
159951 |
bigdaddy |
elvis |
knight |
poohbear |
sydney |
|
1966 |
|
eminem |
kristina |
pookie |
system |
|
1969 |
bigdog |
empire |
lacrosse |
|
taylor |
|
1974 |
bigred |
england |
lakers |
poopoo |
tennis |
|
1975 |
|
enigma |
lalala |
popcorn |
teresa |
|
1977 |
bill |
enter |
lasvegas |
|
test |
|
1978 |
billy |
eric |
lauren |
|
test123 |
|
1979 |
birdie |
eugene |
legend |
porsche |
tester |
|
1980 |
bishop |
everton |
leslie |
power |
testing |
|
1981 |
|
explorer |
letmein |
predator |
theman |
|
1982 |
|
extreme |
liberty |
prince |
therock |
|
1984 |
biteme |
falcon |
lifehack |
princess |
Thomas |
|
1985 |
black |
family |
little |
private |
Thumper |
|
1986 |
blazer |
fantasy |
liverpoo |
psycho |
Thunder |
|
1987 |
blink182 |
fender |
liverpool |
pumpkin |
thx1138 |
|
1988 |
|
ferrari |
lizard |
purple |
Tiffany |
|
1989 |
|
fire |
logitech |
|
Tiger |
|
1990 |
blue |
fireman |
lol123 |
q1w2e3 |
Tigers |
|
1991 |
bobby |
fish |
london |
q1w2e3r4 |
Tigger |
|
1992 |
bollocks |
fishing |
louise |
q1w2e3r4t5 |
Timothy |
|
1993 |
bond007 |
fktrcfylh |
love |
qazwsx |
Tinker |
|
1994 |
bonnie |
florida |
lovelove |
qazwsxedc |
Titanic |
|
1q2w3e |
|
flower |
lovely |
qazxsw |
|
|
1q2w3e4r |
booboo |
fluffy |
loveme |
qqq111 |
Tomcat |
|
1q2w3e4r5t |
|
flyers |
lover |
qqqqqq |
Tommy |
|
1qaz2wsx |
booger |
football |
loverboy |
qwaszx |
Topgun |
|
1qazxsw2 |
boogie |
ford |
lovers |
qwe123 |
Toyota |
|
2000 |
boomer |
forest |
loveyou |
qweasd |
travis |
|
202020 |
boston |
forever |
lucky |
qweasdzxc |
trinity |
|
2112 |
bradley |
francis |
lucky1 |
qweqwe |
trouble |
|
212121 |
brandon |
frank |
maddog |
qwer1234 |
trustno1 |
|
2222 |
brandy |
frankie |
madison |
qwert |
tucker |
|
222222 |
braves |
franklin |
madmax |
qwerty |
turkey |
|
232323 |
brazil |
fred |
madonna |
qwerty1 |
turtle |
|
242424 |
brenda |
freddy |
maggie |
qwerty12 |
tweety |
|
252525 |
brian |
free |
magic |
qwerty123 |
united |
|
315475 |
brittany |
freedom |
magnum |
qwertyu |
|
|
3333 |
bronco |
freepass |
manutd |
qwertyui |
valentin |
|
333333 |
broncos |
freeuser |
marcus |
qwertyuiop |
vampire |
|
420420 |
brooke |
friday |
marina |
rabbit |
vanessa |
|
4321 |
brooklyn |
friend |
marine |
rachel |
vegeta |
|
4444 |
brutus |
friends |
marines |
racing |
veronica |
|
444444 |
bubba |
froggy |
mark |
raider |
vfhbyf |
|
456789 |
bubbles |
|
marlboro |
raiders |
vfrcbv |
|
4815162342 |
buddha |
|
marley |
rainbow |
victor |
|
5150 |
buddy |
|
marshall |
ranger |
victoria |
|
54321 |
budlight |
|
martin |
rangers |
victory |
|
5555 |
buffalo |
|
marvin |
raptor |
viking |
|
55555 |
bulldog |
|
maryjane |
rascal |
vikings |
|
555555 |
bulldogs |
fylhtq |
master |
rasdzv3 |
vincent |
|
55555555 |
bullet |
gabriel |
matrix |
razz |
viper |
|
654321 |
|
galina |
matt |
rebecca |
virginia |
|
6666 |
burton |
galore |
matthew |
red123 |
vision |
|
666666 |
buster |
gandalf |
maverick |
reddog |
vladimir |
|
6969 |
butter |
garfield |
maximus |
redrum |
voodoo |
|
696969 |
butthead |
gateway |
maxwell |
redskins |
Voyager |
|
69696969 |
calvin |
gators |
melanie |
redsox |
Walker |
|
741852963 |
camaro |
gemini |
melissa |
redwings |
Walter |
|
7654321 |
cameron |
general |
member |
reggie |
|
|
7777 |
canada |
genesis |
mercedes |
richard |
Warcraft |
|
777777 |
captain |
genius |
mercury |
robert |
Warrior |
|
7777777 |
cardinal |
george |
merlin |
rock |
Water |
|
77777777 |
carlos |
georgia |
metallic |
rocket |
Welcome |
|
789456 |
carmen |
gfhjkm |
metallica |
rocky |
Westside |
|
789456123 |
carolina |
ghbdtn |
mexico |
roland |
Whatever |
|
852456 |
caroline |
giants |
michael |
rolltide |
Wildcat |
|
8675309 |
carter |
gibson |
michael1 |
rooster |
Wildcats |
|
87654321 |
cartman |
ginger |
michelle |
rosebud |
William |
|
8888 |
casper |
girls |
michigan |
runner |
Williams |
|
888888 |
cassie |
goblue |
mickey |
rush2112 |
Willie |
|
88888888 |
celtic |
godzilla |
midnight |
ruslan |
Willow |
|
9379992 |
champion |
golden |
mike |
russell |
Wilson |
|
987654 |
chance |
golf |
miller |
russia |
Windows |
|
98765432 |
changeme |
golfer |
mine |
sabrina |
Winner |
|
987654321 |
charles |
goober |
minecraft |
saints |
Winston |
|
9999 |
charlie |
|
mitchell |
samantha |
Winter |
|
999999 |
cheese |
gordon |
mmmmmm |
sammy |
Wizard |
|
a12345 |
chelsea |
green |
mnbvcxz |
samson |
Wolf |
|
a123456 |
cherokee |
gregory |
molly |
samsung |
Wolfpack |
|
a1b2c3 |
cherry |
guinness |
monday |
samuel |
Wolverine |
|
aaaa |
chester |
guitar |
money |
sandman |
Wombat |
|
aaaaaa |
chevelle |
gunner |
money1 |
sandra |
Xavier |
|
aaaaaaaa |
chevy |
hahaha |
monica |
sarah |
Xxxx |
|
abc123 |
chicago |
hammer |
monkey |
saturn |
Xxxxxx |
|
abcd1234 |
chicken |
hannah |
monster |
scarface |
Xxxxxxxx |
|
abcdef |
chopper |
happy |
montana |
school |
Yamaha |
|
abcdefg |
chris |
happy1 |
mookie |
scooby |
Yankee |
|
access |
christ |
hard |
morgan |
scooter |
Yankees |
|
accord |
christin |
hardcore |
mother |
scorpio |
Yellow |
|
action |
claire |
harley |
motorola |
scorpion |
Yfnfif |
|
adidas |
classic |
hawaii |
mountain |
scotland |
Zachary |
|
adrian |
claudia |
heather |
mozart |
scott |
zaq12wsx |
|
airborne |
cocacola |
heaven |
muffin |
scotty |
Zombie |
|
alaska |
|
hello |
murphy |
secret |
zxc123 |
|
albert |
coffee |
hello1 |
music |
security |
Zxcvbn |
|
alex |
college |
hello123 |
mustang |
semperfi |
Zxcvbnm |
|
alexande |
colorado |
helpme |
naruto |
serega |
Zzzzzz |
|
alexander |
compaq |
hendrix |
nascar |
sergey |
|
|
alexandr |
computer |
hentai |
natalie |
|
|
|
alexis |
connor |
hiphop |
natasha |
sexy |
|
|
alicia |
cookie |
hitman |
nathan |
shadow |
