CobaltStrikeParser is a Python parser for CobaltStrike Beacon’s configuration. Use parse_beacon_config.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode (default true).Many stageless beacons are PEs where the beacon code itself is stored in the .data section and xored with 4-byte key.The script tries to find the xor key and data heuristically, decrypt the data and …
Continue reading “CobaltStrikeParser : Python parser for CobaltStrike Beacon’s configuration”