metatool.py is a tool to help with the analysis of Metasploit or Cobalt Strike URLs.
More info can be found in my SANS Internet Storm Center diary entry “Finding Metasploit & Cobalt Strike URLs“.
It is still in my Github beta repository here.
Update: 1768.py Version 0.0.5
I updated the analysis logic in this new version of my tool 1768.py to analyze Cobalt Strike beacons.
There’s a new option -c (–csv) to output the config values in CSV format.
And now with option -r (–raw), identical configs are de-duplicated.
1768_v0_0_5.zip (https)
MD5: 83D7A867B93FAC13BA24F17DDA994A9A
SHA256: CBCB84B9C4D8C1ED05983C2A211E3EA6029E69782FDDD6E15181EE4F47383EB5
Update pecheck.py Version 0.7.13
This new version of pecheck.py, my tool to analyze PE files, outputs the hash of the embedded Authenticode signature.
pecheck-v0_7_13.zip (https)
MD5: 5B5179FFBE7530AA60C7182B830B54AB
SHA256: 4CFAF98CC8F3B06E3BBD7D6F37040B47641C38E49BD2975165FB328D50D3F08C