[RESOLVED] Emocheck packet to verify the presence of EMOTET

[wapt42]

Hello everyone.

Following the announcement made by CERT-FR
(https://www.cert.ssi.gouv.fr/alerte/CER ... 0-ALE-019/)

, EMOTET is back!

The resources in this post provide tools such as EmoCheck (


https://github.com/JPCERTCC/EmoCheck

Is it possible to prepare an official package at WAPT so that sysadmins/technicians can deploy it on their systems?

Thank you in advance

. Best regards.

[jpele]

Good morning,

The package has been successfully prepared and is available here: https://store.wapt.fr/store/tis-emocheck

As a bonus, here is the reporting command:

Code: Select all

SELECT computer_name, last_audit_status, package, last_audit_output FROM hosts h
LEFT JOIN hostpackagesstatus hps
ON h.uuid = hps.host_id
WHERE package LIKE 'tis-emocheck'

Sincerely,
Jimmy

[wapt42]

Hi Kevin.

Your reaction was faster than my reply.

Thank you very much for creating this package

. Cheers!

[jacky35]

This reporting command is the absolute holy grail,
You should add it to your WAPT documentation.

Jacky

Good morning,

The package has been successfully prepared and is available here: https://store.wapt.fr/store/tis-emocheck

As a bonus, here is the reporting command:

Code: Select all

SELECT computer_name, last_audit_status, package, last_audit_output FROM hosts h
LEFT JOIN hostpackagesstatus hps
ON h.uuid = hps.host_id
WHERE package LIKE 'tis-emocheck'

Sincerely,
Jimmy