Europol: Emotet Malware Will Uninstall Itself On March 25th
Law enforcement has started to distribute an Emotet module to infected devices that will uninstall the malware on March 25th, 2021.
Today, Europol announced the disruption of the infamous Emotet email spamming botnet used to distribute malicious Word spam attachments that install malware such as TrickBot and Qbot.
These attacks usually lead to the full network compromise of infected companies and the deployment of Ryuk and Conti by TrickBot, and ProLock or Egregor by Qbot.
Emotet to be automatically uninstalled on March 25th
After infecting victims, Emotet will distribute various modules to infected devices that perform different malicious activities.
After today’s Emotet announcement, a security researcher known as Milkream discovered that Emotet had begun to push down a new module to infected devices.
This module will uninstall the Emotet malware from infected devices on March 25th, 2021, at 12:00.
Also Read: Going Beyond DPO Meaning: Ever Heard of Outsourced DPO?
According to milkream, Emotet is now using the following command and control server IP, all located in Germany.
80.158.3[.]161:443
80.158.51[.]209:8080
80.158.35[.]51:80
80.158.63[.]78:443
80.158.53[.]167:80
80.158.62[.]194:443
80.158.59[.]174:8080
80.158.43[.]136:80In a phone call with Europol’s press office, BleepingComputer was told that the German Bundeskriminalamt (BKA) federal police agency was responsible for this action. The press office, though, did not know the date that law enforcement would uninstall the malware.
It unknown why law enforcement is waiting two months to uninstall the malware. BleepingComputer has contacted the BKA with further questions about this operation.
With law enforcement taking control over the botnet and now distributing a module that will uninstall it in March, this could be a significant disruption that will make it very difficult for Emotet to return.
With that said, there were hopes that the US governments and Microsoft disruption of TrickBot in October would have had a long term effect, but TrickBot was soon back up and running.
Also Read: 5 Common Sections in an Agreement Form Example
For now, though, security researchers and professionals are excited by this development. This feeling is especially true for Joseph Roosen of the Cryptolaemus research group, who has been tirelessly monitoring and warning the world of Emotet’s activities.
“I feel great and very hopeful about the future. The collaboration between law enforcement, private sector and volunteers is a beautiful thing to behold,” Roosen told BleepingComputer.
0 Comments