8 skills · sorted by relevance
Extract Cobalt Strike Beacon settings from executable files and memory dumps to identify command-and-control servers, communication patterns, and identifying markers. Use the findings to compare samples, investigate incidents, and develop file and network detection rules.
Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) from a process memory dump by locating decrypted config structures and decoding common obfuscation layers. Activates for requests to extract malware config from a memory dump, recover C2 settings from a running sample, or decode an in-memory configuration block.
The English summary is being prepared. Showing the original description.
Locates candidate encryption keys in a binary by finding high-entropy fixed-size regions (16/24/32 bytes) near cryptographic constants or crypto API references, and surfacing printable key/passphrase strings. Activates for requests to extract encryption keys, find an AES key in a sample, or recover hardcoded crypto material.
The English summary is being prepared. Showing the original description.
Decrypts statically embedded malware configuration blobs by trying common schemes (single-byte and multi-byte XOR, RC4, base64 layers) and scoring decoded output for config-like content. Activates for requests to decrypt an embedded config, recover hardcoded settings from a blob, or brute-force a configuration encryption scheme.
The English summary is being prepared. Showing the original description.
Builds reusable malware configuration extractors by applying a declarative JSON spec (offsets, decode layers, field definitions) to a sample to produce structured, defanged config. Activates for requests to build a config extractor, write a reusable family config parser, or run a spec-driven configuration extraction.
The English summary is being prepared. Showing the original description.
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
The English summary is being prepared. Showing the original description.
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
The English summary is being prepared. Showing the original description.
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
The English summary is being prepared. Showing the original description.