Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
plugxdecoder — Decodes PlugX traffic and encrypted/compressed artifacts | Kitploit
Tools/GitHubGitHub/kcreyts/plugxdecoder
Encryption/Decryption ToolsNetwork ForensicsReverse EngineeringForensicsMalware AnalysisDigital Forensics
GitHubkcreyts/plugxdecoder

plugxdecoder

Decodes PlugX traffic and encrypted/compressed artifacts

View Repository
381313 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

plugxdecoder

Basic Python script which Decodes PlugX traffic and encrypted/compressed artifacts.

Accepting pull requests from those who wish to contribute.

Currently requires: CTypes (with ntdll), dpkt (http://code.google.com/p/dpkt)

Tested with Python 2.7, on Windows.

Long-term goal is to make a pure Python plugin for MITRE's ChopShop.

https://github.com/MITRECND/chopshop

Since I want it to be pure Python, I'll have to do away with the RtlCompressBuffer call to ntdll...

USE THIS AT YOUR OWN RISK, I GUARANTEE NOTHING.

Download Tool