diff --git a/Other/EmoCrash.ps1 b/Other/EmoCrash.ps1 index 1cf71287..00f6f45b 100644 --- a/Other/EmoCrash.ps1 +++ b/Other/EmoCrash.ps1 @@ -1,4 +1,4 @@ -#TLP:GREEN - NOT FOR PUBLIC DISTRIBUTION, TOPIC IS NOT TO BE MENTIONED NOR PUBLISHED ABOUT IN ANY PUBLIC METHODS. +#UPDATE 2021 DEC 16TH. LOWERED TO TLP:WHITE #Thanks to @cryptolaemus https://twitter.com/Cryptolaemus1 and the various contributors of the Emotet Task Force/Working Group #Emotet Innoculation Script [Quinnoculation] @@ -10,7 +10,7 @@ https://twitter.com/Cryptolaemus1 and the various contributors of the Emotet Tas # Authors: James Quinn, Binary Defense # Grabs the VolumeSerialNumbers and sets a registry key in Explorer with type= REG_BINARY and a value too large for Emotet to handle, overwriting the destination buffer, #Which crashes emotet. -#UPDATE 2021 DEC 16TH. LOWERED TO TLP:WHITE + function GenerateData{ [byte[]]$string @@ -46,4 +46,4 @@ New-ItemProperty -Path $AKey -Name $x -Value ([byte[]]($data)) -PropertyType Bin New-ItemProperty -Path $key -Name $x -Value ([byte[]]($data)) -PropertyType Binary -} \ No newline at end of file +}