1768.py's Experimental Mode, (Sat, Mar 23rd)

The reason I extracted a PE file in my last diary entry, is that I discovered it was the dropper of a Cobalt Strike beacon @DebugPrivilege had pointed me to. My 1768.py tool crashed on the process memory dump. This is fixed now, but it still doesn’t extract the configuration.

Article Link: 1768.py's Experimental Mode - SANS Internet Storm Center

1 post - 1 participant

Read full topic

article beacon cobalt cobalt strike configuration dropper entry extract file link memory mode process sat strike tool