Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time



MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a function to list strings to which malicious code refers.

MalConfScan sample

Supported Malware Families

MalConfScan can dump the following malware configuration data, decoded strings or DGA domains:

  • Ursnif
  • Emotet
  • Smoke Loader
  • PoisonIvy
  • CobaltStrike
  • NetWire
  • PlugX
  • RedLeaves / Himawari / Lavender / Armadill / zark20rk
  • TSCookie
  • TSC_Loader
  • xxmm
  • Datper
  • Ramnit
  • HawkEye
  • Lokibot
  • Bebloh (Shiotob/URLZone)
  • AZORult
  • NanoCore RAT
  • AgentTesla
  • FormBook
  • NodeRAT (
  • njRAT
  • TrickBot
  • Remcos
  • QuasarRAT
  • AsyncRAT
  • WellMess (Windows/Linux)
  • Pony

Additional Analysis

MalConfScan has a function to list strings to which malicious code refers. Configuration data is usually encoded by malware. Malware writes decoded configuration data to memory, it may be in memory. This feature may list decoded configuration data.

How to Install

If you want to know more details, please check the MalConfScan wiki.

How to Use

MalConfScan has two functions malconfscan, linux_malconfscan and malstrscan.

Export known malware configuration

$ python malconfscan -f images.mem --profile=Win7SP1x64

Export known malware configuration for Linux

$ python linux_malconfscan -f images.mem --profile=LinuxDebianx64

List the referenced strings

$ python malstrscan -f images.mem --profile=Win7SP1x64

Overview & Demonstration

Following YouTube video shows the overview of MalConfScan.


And, following YouTube video is the demonstration of MalConfScan.


MalConfScan with Cuckoo

Malware configuration data can be dumped automatically by adding MalConfScan to Cuckoo Sandbox. If you need more details on Cuckoo and MalConfScan integration, please check MalConfScan with Cuckoo.