Law enforcement has started to distribute an Emotet module to infected devices that will uninstall the malware on March 25th, 2021.

Today, Europol announced the disruption of the infamous Emotet email spamming botnet used to distribute malicious Word spam attachments that install malware such as TrickBot and Qbot.

These attacks usually lead to the full network compromise of infected companies and the deployment of Ryuk and Conti by TrickBot, and ProLock or Egregor by Qbot.

Emotet to be automatically uninstalled on March 25th

After infecting victims, Emotet will distribute various modules to infected devices that perform different malicious activities.

After today’s Emotet announcement, a security researcher known as Milkream discovered that Emotet had begun to push down a new module to infected devices.

This module will uninstall the Emotet malware from infected devices on March 25th, 2021, at 12:00.

All Emotet epochs now are delivering the payload (https://t.co/Tv21VmJm4s) which has the code to remove Emotet on 25 March 2021 12:00. I believe that #Emotet #Killed pic.twitter.com/FnrdqZmQcd

— milkream (@milkr3am) January 27, 2021

According to milkream, Emotet is now using the following command and control server IP, all located in Germany.

80.158.3[.]161:443
80.158.51[.]209:8080
80.158.35[.]51:80
80.158.63[.]78:443
80.158.53[.]167:80
80.158.62[.]194:443
80.158.59[.]174:8080
80.158.43[.]136:80

In a phone call with Europol’s press office, BleepingComputer was told that the German Bundeskriminalamt (BKA) federal police agency was responsible for this action. The press office, though, did not know the date that law enforcement would uninstall the malware.

It unknown why law enforcement is waiting two months to uninstall the malware. BleepingComputer has contacted the BKA with further questions about this operation.

With law enforcement taking control over the botnet and now distributing a module that will uninstall it in March, this could be a significant disruption that will make it very difficult for Emotet to return.

With that said, there were hopes that the US governments and Microsoft disruption of TrickBot in October would have had a long term effect, but TrickBot was soon back up and running.