Memory-analysis
Contains tools to perform malware and forensic analysis in Memory.
Plugins:
- Dyrescan.py - parses Dyreconfig in memory.
- Rat9002.py - parses 9002 rat config in memory.
- plugx.py - parses plugx config in memory (modified to also parse config size: 0x170c).
- ghostrat.py - parses ghostrat config in memory.
Analysis_Script:
- vol_analysis.sh - script to automate analysis with volatility
- common_search_strings.txt - textfile used by vol_analysis.sh to search for common commands used by threat actors. Fill out with your own terms.
- drv_list.txt - List gathered from the Internet with all known bad and good drivernames. Used by vol_analysis.sh to search for bad drivers.
Irma:
- Created a python script to interact with IRMA on a localmachine. This script is also used by vol_analysis.sh to submit and scan all files extracted from a memory dump and perform analysis on them with various AV-engines.
- Usage with vol_analysis script: vol_analysis.sh -p WinXPSP2x86 -f memdump.mem -d /output_path -t CASENAME ** Requires IRMA up and running on your machine and the IRMACL API installed.