Unpacking and decryption tools for the Emotet malware by Deep Instinct.
The first tool is a static unpacker for the variants of the Emotet loader listed in Loaders-SHA256.txt. It can extract the encrypted payload from the resource without executing the malware.
The Python scripts reveal the hidden strings and API calls the payload uses. The first one is a standalone script that can be used to extract this information from a large number of payloads. The second one is an IDA plugin. It adds this information as comments in the code.
