New EmoCheck Tool Checks if You're Infected With Emotet

guest · Feb 3, 2020

New EmoCheck Tool Checks if You're Infected With Emotet
February 3, 2020
https://www.bleepingcomputer.com/ne...ck-tool-checks-if-youre-infected-with-emotet/

A new utility has been released by Japan CERT (computer emergency response team) that allows Windows users to easily check if they are infected with the Emotet Trojan.

The Emotet Trojan is one of the most actively distributed malware that is spread through phishing emails with malicious Word document attachments.
Due to its severity, it is important that victims quickly find and remove the Emotet Trojan before it can download and install other malware onto an infected computer.
Click to expand...

To check if you are infected with Emotet, you can download the EmoCheck utility from the Japan CERT GitHub repository.
Click to expand...

Once downloaded, extract the zip file and double-click on the emocheck_x64.exe (64-bit version) or emocheck_x86.exe (32-bit version) depending on what you downloaded.
Once running, EmoCheck will scan for the Emotet Trojan and alert you if it is found, what process ID it is running under, and the location of the malicious file.

This tool could also be useful for network administrators to use as part of a login script to quickly find machines that have been infected with Emotet to prevent a full-blown ransomware attack.
Click to expand...

guest · Mar 23, 2020

EmoCheck v0.0.2 Released (February 10, 2020)
Download (GitHub)

v0.0.2
New
• added quiet mode (no console output mode)
• added JSON reporting mode
• added a option to set output directory for the report
Update
• update detection method
Click to expand...

Update (March 10th, 2020)
Code signing with Microsoft Authenticode.
Click to expand...

Tarnak · Mar 23, 2020

Just as I expected:

guest · Aug 11, 2020

EmoCheck v1.0 Released (August 11, 2020)
Download (GitHub)

1.0
New
• added support the April 2020 updated of Emotet
Update
• update code obfuscation
Click to expand...

guest · Aug 11, 2020

Check whether your PC is infected with the Emotet malware
August 11, 2020
https://www.ghacks.net/2020/08/11/check-whether-your-pc-is-infected-with-the-emotet-malware/

The malware Emotet was detected for the first time in 2014. Back then, it was designed as a banking trojan to steal sensitive information. The malware evolved over time and added more malicious activity such as spamming to its arsenal through "loading" functionality.

You may also run the open source tool EmoCheck if you just want to find out if a system is infected.
The portable tool scans the system for Emotet characteristics to reveal if it is infected. All it takes is to download the 32-bit or 64-bit version of EmoCheck from the GitHub project site and run it on a Windows system.

The program displays the result of the scan in the interface and saves a text log file on the system as well. You can also run it from the command line using parameters such as /quiet, /json, or /output path, to run the program without console output, export the data as a JSON file, or change the default output directory.
Click to expand...

Closing Words
EmoCheck offers a quick way to find out if a Windows system is infected by the Emotet malware. You don't need the program if your resident antivirus solution detects all the different iterations of the malware, as the system is protected against it in this case.

If you are not certain if that is the case, you may run EmoCheck to find out if the system is infected or not. First thing to do if the system is infected is to disconnect it from the network/Internet to remove the malware afterwards using an antivirus solution that detects and cleans it.
Click to expand...

guest · Jan 27, 2021

EmoCheck v2.0 Released (January 27, 2021)
Download (GitHub)

New

added support the December 2020 updated of Emotet

added support French language

Click to expand...

guest · Mar 4, 2022

EmoCheck 2.1 Released (March 4, 2022)
Download (GitHub)

New

added support the February 2022 updated of Emotet

Click to expand...

emocheck_v2.1_x86.exe
MD5 : 512565777fd64098b031018fabf64884
SHA256: 4bf1f687e78c1547ca7fe8d157b8d718027ed241689d8a3a2233c198efef5fb5

emocheck_v2.1_x64.exe
MD5 : c866892c5b187d6ef45e1d44388edd69
SHA256: 8d701baf910408cd27b8487ba3c854b05178b431878acc2c5dba1f87e0b671b4
Click to expand...

Log in or Sign up

New EmoCheck Tool Checks if You're Infected With Emotet

guest Guest

guest Guest

Tarnak Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

New EmoCheck Tool Checks if You're Infected With Emotet

guest Guest

guest Guest

Tarnak Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches