dissect.cobaltstrike 1.2.1.dev12__tar.gz → 1.2.1.dev13__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/PKG-INFO +1 -1
  2. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/_version.py +2 -2
  3. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/beacon.py +2 -1
  4. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/version.py +4 -0
  5. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/.github/workflows/dissect-ci.yml +0 -0
  6. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/.gitignore +0 -0
  7. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/.lfs-assets-id +0 -0
  8. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/.pre-commit-config.yaml +0 -0
  9. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/.readthedocs.yml +0 -0
  10. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/LICENSE +0 -0
  11. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/README.rst +0 -0
  12. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/codecov.yml +0 -0
  13. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/__init__.py +0 -0
  14. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/artifact.py +0 -0
  15. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/c2.py +0 -0
  16. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/c2profile.lark +0 -0
  17. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/c2profile.py +0 -0
  18. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/c_c2.py +0 -0
  19. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/client.py +0 -0
  20. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/guardrails.py +0 -0
  21. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/pcap.py +0 -0
  22. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/pe.py +0 -0
  23. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/utils.py +0 -0
  24. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/xordecode.py +0 -0
  25. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/Makefile +0 -0
  26. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/c2profile-grammar.rst +0 -0
  27. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/codespell-ignore-words.txt +0 -0
  28. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/conf.py +0 -0
  29. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/examples.rst +0 -0
  30. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/images/beacon-client.png +0 -0
  31. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/images/teamserver-echoclient.png +0 -0
  32. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/images/teamserver_ls.png +0 -0
  33. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/images/vt-cobaltstrike-43-zip.png +0 -0
  34. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/index.rst +0 -0
  35. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/installation.rst +0 -0
  36. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/license.rst +0 -0
  37. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/scripts/checksum8-accesslogs.rst +0 -0
  38. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/scripts/dump_beacon_keys.rst +0 -0
  39. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/scripts/example_client.rst +0 -0
  40. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/scripts/index.rst +0 -0
  41. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/structures/c2_def.rst +0 -0
  42. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/structures/cs_def.rst +0 -0
  43. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/structures/guardrails_def.rst +0 -0
  44. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/structures/index.rst +0 -0
  45. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/structures/pe_def.rst +0 -0
  46. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tools/beacon-artifact.rst +0 -0
  47. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tools/beacon-client.rst +0 -0
  48. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tools/beacon-dump.rst +0 -0
  49. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tools/beacon-pcap.rst +0 -0
  50. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tools/beacon-xordecode.rst +0 -0
  51. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tools/c2profile-dump.rst +0 -0
  52. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tutorials/decrypt_cobaltstrike_pcaps.rst +0 -0
  53. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tutorials/index.rst +0 -0
  54. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/docs/tutorials/minimal_beacon_client.rst +0 -0
  55. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/pyproject.toml +0 -0
  56. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/scripts/checksum8-accesslogs.py +0 -0
  57. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/scripts/dump_beacon_keys.py +0 -0
  58. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/scripts/example_client.py +0 -0
  59. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/conftest.py +0 -0
  60. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_beacon.py +0 -0
  61. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_c2.py +0 -0
  62. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_c2profile.py +0 -0
  63. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_client.py +0 -0
  64. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_guardrails.py +0 -0
  65. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_pe.py +0 -0
  66. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_utils.py +0 -0
  67. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_version.py +0 -0
  68. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tests/test_xordecode.py +0 -0
  69. {dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/tox.ini +0 -0
{dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: dissect.cobaltstrike
3
- Version: 1.2.1.dev12
3
+ Version: 1.2.1.dev13
4
4
  Summary: a Python library for dissecting Cobalt Strike related data
5
5
  Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
6
6
  Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
{dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/_version.py RENAMED
@@ -17,5 +17,5 @@ __version__: str
17
17
  __version_tuple__: VERSION_TUPLE
18
18
  version_tuple: VERSION_TUPLE
19
19
 
20
- __version__ = version = '1.2.1.dev12'
21
- __version_tuple__ = version_tuple = (1, 2, 1, 'dev12')
20
+ __version__ = version = '1.2.1.dev13'
21
+ __version_tuple__ = version_tuple = (1, 2, 1, 'dev13')
{dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/beacon.py RENAMED
@@ -1198,10 +1198,11 @@ def main():
1198
1198
  if args.verbose >= 1:
1199
1199
  print("-" * 50)
1200
1200
  print(
1201
- "pe_export_stamp = {}, {}, {}".format(
1201
+ "pe_export_stamp = {}, {}, {} - {}".format(
1202
1202
  config.pe_export_stamp,
1203
1203
  hex(config.pe_export_stamp),
1204
1204
  time.ctime(config.pe_export_stamp),
1205
+ config.version,
1205
1206
  )
1206
1207
  )
1207
1208
  print(
{dissect_cobaltstrike-1.2.1.dev12 → dissect_cobaltstrike-1.2.1.dev13}/dissect/cobaltstrike/version.py RENAMED
@@ -87,6 +87,10 @@ PE_EXPORT_STAMP_TO_VERSION: Dict[int, str] = {
87
87
  0x66915020: "Cobalt Strike 4.10 (Jul 16, 2024)",
88
88
  0x66915022: "Cobalt Strike 4.10 (Jul 16, 2024)",
89
89
  0x66915024: "Cobalt Strike 4.10 (Jul 16, 2024)",
90
+ 0x66915027: "Cobalt Strike 4.10 (Jul 16, 2024)",
91
+ 0x674E0D02: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
92
+ 0x674E0D13: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
93
+ 0x674E0D17: "Cobalt Strike 4.10.1 (Dec 10, 2024)",
90
94
  }
91
95
  """ PE export timestamp to Cobalt Strike version mapping """
92
96