Artifact analysis tools by JPCERT/CC Analysis Center
IDA plugin Tool to deobfuscate CFF used by NOOPLDR malware
Article/Blog entry:
https://blogs.jpcert.or.jp/ja/2024/07/mirrorface.html (Japanese)
C2 Commands Emulation tools in go language that supports analysis of GobRAT malware
Article/Blog entry:
https://blogs.jpcert.or.jp/ja/2023/05/gobrat.html (Japanese)
https://blogs.jpcert.or.jp/en/2023/05/gobrat.html (English)
Volatility plugin for detecting APT17 related malware and extracting its config
Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-aptscan.html (Japanese)
http://blog.jpcert.or.jp/2015/11/a-volatility-plugin-created-for-detecting-malware-used-in-targeted-attacks.html (English)
Python script for decoding Emdivi's post data
Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-emdivi.html (Japanese)
http://blog.jpcert.or.jp/2015/11/decrypting-strings-in-emdivi.html (English)
IDAPython script for decrypting strings inside Emdivi
Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-emdivi.html (Japanese)
http://blog.jpcert.or.jp/2015/11/decrypting-strings-in-emdivi.html (English)
Data decryption tool for Citadel
Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-citadel.html (Japanese)
http://blog.jpcert.or.jp/2016/02/banking-trojan--27d6.html (English)
Python script for decoding strings inside Adwind
Article/Blog entry:
https://www.jpcert.or.jp/magazine/acreport-adwind.html (Japanese)
http://blog.jpcert.or.jp/2016/05/decoding-obfuscated-strings-in-adwind.html (English)
Volatility plugin for detecting RedLeaves and extracting its config
Article/Blog entry:
https://www.jpcert.or.jp/magazine/acreport-redleaves2.html (Japanese)
http://blog.jpcert.or.jp/2017/05/volatility-plugin-for-detecting-redleaves-malware.html (English)
Python script for detects Datper communication and adds result field to Splunk index
Article/Blog entry:
https://www.jpcert.or.jp/magazine/acreport-search-datper.html (Japanese)
http://blog.jpcert.or.jp/2017/09/chase-up-datper-bba7.html (English)
Python script for detects Datper communication and adds result field to Elasticsearch index
Article/Blog entry:
https://www.jpcert.or.jp/magazine/acreport-search-datper.html (Japanese)
http://blog.jpcert.or.jp/2017/09/chase-up-datper-bba7.html (English)
Python script for decrypting and parsing TSCookie configure data
Article/Blog entry:
https://www.jpcert.or.jp/magazine/acreport-tscookie.html (Japanese)
http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html (English)
Python script for decoding WellMess's cookie data (support Python2)
Article/Blog entry:
https://blogs.jpcert.or.jp/ja/2018/06/wellmess.html (Japanese)
https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html (English)
Volatility plugin for detecting Cobalt Strike Beacon and extracting its config
Article/Blog entry:
https://www.jpcert.or.jp/magazine/acreport-cobaltstrike.html (Japanese)
https://blog.jpcert.or.jp/2018/08/volatility-plugin-for-detecting-cobalt-strike-beacon.html (English)
Python script for decrypting and parsing TSCookie configure data
Article/Blog entry:
https://blogs.jpcert.or.jp/ja/2019/09/tscookie_loader.html (Japanese)
https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html (English)