I release Immunity Debugger and IDAPython scirpts dumping PlugX configs (and original PEs) then parsing them. IIJ-SECT (CSIRT team at IIJ, Inc.) classifies PlugX samples into 3 types: type I/II/III. In more detail, check our presentation. The Immunity Debugger script can be used for PlugX type I&II. The IDAPython script can parse type III configs. Distinction between Type I&II and III Before using