Cobalt Strike beacons have many configuration options: all these options are stored in an encoded and embedded table. 1768.py is a tool that can decode/decrypt Cobalt Strike beacons, and extract their configuration. Once the full beacon has been saved to disk as EbHm.vir, it can be analyzed with tool 1768.py.

The download of the full beacon is captured too: Figure 3: full beacon downloadĪnd we can extract this download: Figure 4: export HTTP objects Figure 5: selecting download EbHm for saving Figure 6: saving selected download to disk The output of the tool shows that this is a valid path to download a 32-bit full beacon (CS x86).

More info on this checksum process can be found here. We can check this with the tool metatool.py like this: Figure 2: using metatool.py The path used in the GET request to download the full beacon, consists of 4 characters that satisfy a condition: the byte-value of the sum of the character values (aka checksum 8) is a known constant. Figure 1: packet capture for Cobalt Strike traffic In this first step, we search for signs of stager shellcode in the capture file: we do this with the following display filter: matches “/….$”.

The full beacon: a PE file that can be reflectively loaded.

A small piece of shellcode (a couple of hundred bytes), aka the stager shellcode, that downloads the full beacon.

If you want to know more about Cobalt Strike and its components, we highly recommend the following blog post.įirst step: we open the capture file with Wireshark, and look for downloads of a full beacon by stager shellcode.Īlthough beacons can come in many forms, we can identify 2 major categories: We start with a minimum of knowledge: the capture file contains encrypted HTTP traffic of a Cobalt Strike beacon communicating with its team server. If you haven’t already, we invite you to read part 1 first: Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1.įor this analysis, we are using capture file, this is one of the many malware traffic capture files that Brad Duncan shares on his web site. This analysis includes decryption of the C2 traffic. In this blog post, we will analyze a Cobalt Strike infection by looking at a full packet capture that was taken during the infection. We decrypt Cobalt Strike traffic using one of 6 private keys we found. This entry is part 2 in the series Cobalt Strike: Decrypting Traffic

Wireshark https traffic decrypt