admin/Sentinel-One-CobaltStrikeParser
1
0
Fork 0
mirror of https://github.com/Sentinel-One/CobaltStrikeParser synced 2026-06-21 13:45:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adds unit-test for encrypted x86

Browse Source
This commit is contained in:
Nicolas Bareil
2021-05-07 01:42:48 -07:00
parent 845f8269d5
commit aa6e4f5b56
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
samples/7773169ca4ea81203a550dfebe53f091a8c57a3a5b12386e51c5a05194fef3ff.zip
BIN
View File
Binary file not shown.
test_parse_beacon_config.py
+11
View File
@@ -38,6 +38,17 @@ class TestBeaconParsing(unittest.TestCase):
conf = parser.parse_encrypted_config()
self.assertEqual(conf.get("PublicKey_MD5"), "d2c8ec15d925e2514714d619022f7cdf")
def test_encrypted_x86(self):
path = os.path.join(
os.path.dirname(__file__),
"samples",
"7773169ca4ea81203a550dfebe53f091a8c57a3a5b12386e51c5a05194fef3ff.zip",
)
f = decrypt_sample(path)
parser = cobaltstrikeConfig(f)
conf = parser.parse_encrypted_config()
self.assertEqual(conf.get("PublicKey_MD5"), "8ac540617dddcdf575f6dc207abb7344")
if __name__ == "__main__":
unittest.main()