From 028b7b44ca38b197a3be6a1d7527baeed1403350 Mon Sep 17 00:00:00 2001 From: vxunderground <57078196+vxunderground@users.noreply.github.com> Date: Thu, 16 Dec 2021 12:12:06 -0600 Subject: [PATCH] Update EmoCrash.ps1 --- Other/EmoCrash.ps1 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Other/EmoCrash.ps1 b/Other/EmoCrash.ps1 index 1cf71287..00f6f45b 100644 --- a/Other/EmoCrash.ps1 +++ b/Other/EmoCrash.ps1 @@ -1,4 +1,4 @@ -#TLP:GREEN - NOT FOR PUBLIC DISTRIBUTION, TOPIC IS NOT TO BE MENTIONED NOR PUBLISHED ABOUT IN ANY PUBLIC METHODS. +#UPDATE 2021 DEC 16TH. LOWERED TO TLP:WHITE #Thanks to @cryptolaemus https://twitter.com/Cryptolaemus1 and the various contributors of the Emotet Task Force/Working Group #Emotet Innoculation Script [Quinnoculation] @@ -10,7 +10,7 @@ https://twitter.com/Cryptolaemus1 and the various contributors of the Emotet Tas # Authors: James Quinn, Binary Defense # Grabs the VolumeSerialNumbers and sets a registry key in Explorer with type= REG_BINARY and a value too large for Emotet to handle, overwriting the destination buffer, #Which crashes emotet. -#UPDATE 2021 DEC 16TH. LOWERED TO TLP:WHITE + function GenerateData{ [byte[]]$string @@ -46,4 +46,4 @@ New-ItemProperty -Path $AKey -Name $x -Value ([byte[]]($data)) -PropertyType Bin New-ItemProperty -Path $key -Name $x -Value ([byte[]]($data)) -PropertyType Binary -} \ No newline at end of file +}