Skip to content

Instantly share code, notes, and snippets.

@sysopfb
Created July 25, 2017 15:55
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save sysopfb/593b35416a8133a46a5c62a22f50db47 to your computer and use it in GitHub Desktop.
Emotet v5 protocol
syntax="proto2";
message regrequest {
required int32 command = 1;
required string botId = 2;
required fixed32 osVersion = 3;
required fixed32 crc32 = 4;
required string procList = 5;
required string mailClient = 6;
required string unknown = 7;
}
message Request1 {
required int32 command = 1;
required bytes reqdata = 2; //zlib level 0 compressed regquest message
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment