Emotet Detection Software For Home windows OS

Emotet detection device for Home windows OS.

Learn how to use

1. Obtain EmoCheck from the Releases web page.
2. Run EmoCheck on the host.
3. Examine the exported report.

Please obtain from the Releases web page.

Command choices

(since v0.0.2)

• Specify output listing for the report (default: present listing)
  • /output [your output directory] or -output [your output directory]
• No console output
• Export the report in JSON model
• Debug mode (no report)
• Present assist

How EmoCheck detects Emotet

(v0.0.1)
Emotet generates their course of identify from a particular phrase dictionary and C drive serial quantity. EmoCheck scans the working course of on the host, and discover Emotet course of from their course of identify.

(added in v0.0.2)
Emotet retains their encoded course of identify in a particular registry key. EmoCheck appears up and decode the registry worth, and discover it from the method record. Code Signing with Microsoft Authenticode.

(added in v1.0)
Assist the April 2020 up to date of Emotet.
Obfuscated code.

(added in v2.0)
Assist the December 2020 up to date of Emotet.
French language assist. (Because of CERT-FR)

Pattern Report

Textual content stlye:

[Emocheck v0.0.2]
Scan time: 2020-02-10 13:06:20
____________________________________________________
[Result]
Detected Emotet course of.
[Emotet Process]
Course of Identify  : mstask.exe
Course of ID    : 716
Picture Path    : C:Customers[username]AppDataLocalmstask.exe
____________________________________________________
Please take away or isolate the suspicious execution file.

JSON model (added in v0.0.2):

{
"scan_time":"2020-02-10 13:06:20",
"hostname":"[your hostname]",
"emocheck_version":"0.0.2",
"is_infected":"sure",
"emotet_processes":[
{
"process_name":"mstask.exe",
"process_id":"716",
"image_path":"C:Users[username]AppDataNativemstask.exe"
}
]
}

The report might be exported to the next path.

(v0.0.1)
[current directory]yyyymmddhhmmss_emocheck.txt

(since v0.0.2)
[output path][computer name]_yyyymmddhhmmss_emocheck.txt
[output path][computer name]_yyyymmddhhmmss_emocheck.json

Screenshot

(v0.0.1)

Releases

• (Feb. 3, 2020) v0.0.1
• (Feb. 10, 2020) v0.0.2
  • replace detecting technique
  • add choices
• (Aug. 11, 2020) v1.0.0
• (Jan. 27, 2021) v2.0.0
  • replace detecting technique
  • Added French language assist
• (Mar. 4, 2022) v2.1.0
• (Mar. 14, 2022) v2.1.1
  • Mounted a crash bug when executing with SYSTEM privileges
• (Apr. 22, 2022) v2.2.0
• (Might. 20, 2022) v2.3.0
• (Might. 24, 2022) v2.3.1
  • fastened a detection sample
• (Might. 27, 2022) v2.3.2
  • fastened a detection sample

License

Please learn the LICENSE web page.

Notes

Examined environments

• Home windows 11 21H2 64bit Japanese Version
• Home windows 10 21H2 64bit Japanese Version
• Home windows 8.1 64bit Japanese Version
• Home windows 7 SP1 32bit Japanese Version
• Home windows 7 SP1 64bit Japanese Version

Home windows 7 doesn’t assist UTF-8 output within the Command Immediate.

Construct

• Home windows 10 1809 64bit Japanese Version
• Microsoft Visible Studio Group 2017

Supply code

Not revealed from v2.1.