diff --git a/samples/10fd211ba97ddf12aecb1e7931d92c3ba37421c362cb1490e0203c1bd88ec141.zip b/samples/10fd211ba97ddf12aecb1e7931d92c3ba37421c362cb1490e0203c1bd88ec141.zip new file mode 100644 index 0000000..eea03f2 Binary files /dev/null and b/samples/10fd211ba97ddf12aecb1e7931d92c3ba37421c362cb1490e0203c1bd88ec141.zip differ diff --git a/test_parse_beacon_config.py b/test_parse_beacon_config.py index aa240f5..a01382f 100644 --- a/test_parse_beacon_config.py +++ b/test_parse_beacon_config.py @@ -26,6 +26,17 @@ class TestBeaconParsing(unittest.TestCase): parser = cobaltstrikeConfig(f) conf = parser.parse_encrypted_config() self.assertEqual(conf.get("HttpPostUri"), "/submit.php") + + def test_encrypted_x86_64(self): + path = os.path.join( + os.path.dirname(__file__), + "samples", + "10fd211ba97ddf12aecb1e7931d92c3ba37421c362cb1490e0203c1bd88ec141.zip", + ) + f = decrypt_sample(path) + parser = cobaltstrikeConfig(f) + conf = parser.parse_encrypted_config() + self.assertEqual(conf.get("PublicKey_MD5"), "d2c8ec15d925e2514714d619022f7cdf") if __name__ == "__main__":