Skip to main content

Decode FIN6 Cobalt Strike stagers


This post explains about decoding FIN6 cobalt strike stagers using cyberchef and scdbg. Attackers leverage pastebin to host cobalt strike stagers or malicious droppers and few of them are still active on pastebin though the final c2 or  domains are not active. Below is one of those pastebin httpstagers 

  • hxxps://pastebin[.]com/raw/HPpvY00Q.


One of my previous posts Decoding Metasploit and CobaltStrike shells explains how to use CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg emulator to get the IP address of C2. Here scdbg command line version for linux is used to emulate the shellcode 


References: 


Labels:

Comments

  1. Jacob28 August 2025 at 09:04

    The intricate dance of words and ideas here left me utterly captivated—it’s rare to find a piece that both challenges and charms in equal measure. A refreshing read that lingers long after the screen dims. 🌙 darknet markets onion

    ReplyDelete

Post a Comment

Popular posts from this blog

Memory Analysis of WannaCry Ransomware

Introduction  This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC)  WannaCry  WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Discalimer You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a...
67 comments
Read more

Analyze Sysmon for Linux logs using Kusto Query Language

Recently I have come across a situation where I need to install Sysmon on a Linux virtual machine in Azure subscription and analyze those logs in Log analytics workspace. This post is a quick guide to help installing Sysmon and analyzing logs using Kusto query language.  Prerequisites to install Sysmon for Linux  Ensure the Linux virtual machine is on boarded to Log analytics workspace.  Collect Syslog events with Azure Monitor Agent. Install using this Installing Sysmon on Linux  For complete installation process on various .nix operating systems, follow Sysmon installation instructions here    Ubuntu 20.04 & 22.04  Register Microsoft key and feed wget -q https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb sudo dpkg -i packages-microsoft-prod.deb  Install SysmonForLinux sudo apt-get update sudo apt-get install sysmonforlinux The Kusto query to parse the Sysmon logs on a Li...
Post a Comment
Read more

CVE-2021-38647 OMIGod Exploitation Log Analysis using Kusto Query Language

INTRODUCTION This post walks you through the log analysis of OMIGod vulnerability exploitation artefacts using kusto query language (KQL). The raw json logs from exploited linux device are fetched into Azure KQL data explorer using externaldata() function and analysed in KQL instance. I have been learning Kusto Query Language as part of my routine and KQL experts can write better queries to fine tune json data than what I have mentioned here  The Linux device with vulnerable OMI version is configured with Linux Audit Daemon with the best practice configuration  This blog explains about setting up your own private pwn lab for OMI exploitation  This great Linux Logging with AuditD video by  IppSec   explains how to set up linux logging with Auditd. Below are all the comments by IppSec from the video (no comments from me and full credit goest to IppSec) Installing Auditd Downloading a good baseline ruleset from github  Going over the baseline file to un...
Post a Comment
Read more