aa-tools

Artifact analysis tools by JPCERT/CC Analysis Center

apt17scan.py

Volatility plugin for detecting APT17 related malware and extracting its config

Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-aptscan.html (Japanese)
http://blog.jpcert.or.jp/2015/11/a-volatility-plugin-created-for-detecting-malware-used-in-targeted-attacks.html (English)

emdivi_postdata_decoder.py

Python script for decoding Emdivi's post data

Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-emdivi.html (Japanese)
http://blog.jpcert.or.jp/2015/11/decrypting-strings-in-emdivi.html (English)

emdivi_string_decryptor.py

IDAPython script for decrypting strings inside Emdivi

Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-emdivi.html (Japanese)
http://blog.jpcert.or.jp/2015/11/decrypting-strings-in-emdivi.html (English)