From 522e37f639d032b1432cfcc25607c874775cbb84 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Karol=20Troci=C5=84ski?= Date: Sat, 26 Oct 2019 10:00:23 +0000 Subject: [PATCH] Add MalConfScan volatility plugin. --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index d5c2acb..90d3f57 100644 --- a/README.md +++ b/README.md @@ -142,6 +142,7 @@ Digital Forensics and Incident Response (DFIR) teams are groups of people in an * [VolatilityBot](https://github.com/mkorman90/VolatilityBot) - Automation tool for researchers cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation. * [VolDiff](https://github.com/aim4r/VolDiff) - Malware Memory Footprint Analysis based on Volatility. * [WindowsSCOPE](http://www.windowsscope.com/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=35&category_id=3&option=com_virtuemart) - Memory forensics and reverse engineering tool used for analyzing volatile memory offering the capability of analyzing the Windows kernel, drivers, DLLs, and virtual and physical memory. +* [MalConfScan](https://github.com/JPCERTCC/MalConfScan) - MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a function to list strings to which malicious code refers. ### Memory Imaging Tools