Artifact analysis tools by JPCERT/CC Analysis Center
Volatility plugin for detecting APT17 related malware and extracting its config
Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-aptscan.html (Japanese)
http://blog.jpcert.or.jp/2015/11/a-volatility-plugin-created-for-detecting-malware-used-in-targeted-attacks.html (English)
Python script for decoding Emdivi's post data
Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-emdivi.html (Japanese)
http://blog.jpcert.or.jp/2015/11/decrypting-strings-in-emdivi.html (English)
IDAPython script for decrypting strings inside Emdivi
Article/Blog entry:
http://www.jpcert.or.jp/magazine/acreport-emdivi.html (Japanese)
http://blog.jpcert.or.jp/2015/11/decrypting-strings-in-emdivi.html (English)
Data decryption tool for Citadel