EmoCheck utility will detect Emotet infection

The Bleeping Computer publication noted that the developers of the Japanese CERT have created a special tool, the EmoCheck utility, which will allow Windows users to detect infection by the Emotet malware.

Recall that Emotet is currently one of the most active Trojans, it even topped the 2019 threat rating.

Emotet spreads with email spam through malicious Word documents. Such letters can be masked as various messages that may interest the user. Some researchers report that up to 85% of emails sent in 2019 contained spam and links to malicious files.

These emails pretend to be invoices, shipping notices, account reports, holiday party invites, and even information about the Coronavirus in the hopes that you will be enticed, or tricked, into opening the attachment”, — write Bleeping Computer journalists.

Overall, hackers are closely monitoring global trends and constantly improving their bait letters.

Having penetrated the victim’s system, Emotet uses the infected machine for further spamming, and also installs additional malware on the device. This is often the Trickbot banker (which steals credentials, cookies, browser history, SSH keys, and so on).

If the network is of high-value, TrickBot will also open a reverse shell back to the Ryuk Ransomware operators who will encrypt the network as a final payload”, — report IS specialists.

Due to the severity of the threat, it is important for victims to quickly find and remove the Emotet Trojan before it can download and install other malware on the infected computer.

Japanese experts have created a special tool EmoCheck, which allows quick and easy detection of infection in the system.

To check if you are infected with Emotet, you can download the EmoCheck utility from the Japan CERT GitHub repository.

Having scanned the system, EmoCheck will notify user that Emotet is detected, and it will also report the process ID associated with the malware and the location of the malicious file.

If using EmoCheck you find that the computer is infected, you should immediately open the task manager and complete the specified process. Then you should check your computer with reliable anti-virus software to make sure that other malware has not been downloaded and installed on your computer yet”, – say experts at Bleeping Computer.

This tool can also be useful to system administrators for quick scan of the find infected machines and, perhaps, help prevent a full-scale ransoware attack.