MalConfScan

A command-line utility to show and change EXIF information in JPEG files

MalConfScan is a Volatility plugin designed to extract configuration data from known malware. It searches for malware within memory images and dumps the relevant configuration data.

It also includes a feature that lists the strings referenced by malicious code. The supported malware families are Ursnif, Emotet, Smoke Loader, PoisonIvy, CobaltStrike, among others. Furthermore, it can extract decoded strings or DGA domains. MalConfScan also offers additional analysis by listing the strings that malicious code refers to and decoding configuration data that is typically encoded by malware.