# New Tool: cs-extract-key.py

**[blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/](https://blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/)**

## Wednesday 3 November 2021


November 3, 2021


[Filed under: Announcement,Encryption,My Software — Didier Stevens @ 0:00](https://blog.didierstevens.com/category/announcement/)

cs-extract-key.py is a tool designed to extract cryptographic keys from Cobalt Strike beacon
process memory dumps.

[This tool was already available in my beta repository.](https://github.com/DidierStevens/Beta)

This tool can extract cryptographic keys from process memory dumps of a version 3.x
beacon directly:

And from version 4.x together with encrypted data extracted from network capture:

More details can be found in the man page, and in and upcoming blog post.


-----

[cs-extract-key_V0_0_1.zip (https)](http://didierstevens.com/files/software/cs-extract-key_V0_0_1.zip)
MD5: 4102A5A5BFD4D432DA4A721D43F568F5
SHA256:
BBEDF6CBFFF51669187694F463C32A49F53420BEDF8B76508D06850643DE334F
[Comments (1)](https://blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/#comments)

## 1 Comment »

1. […] New Tool: cs-extract-key.py […]

_[Pingback by Week 45 – 2021 – This Week In 4n6 — Sunday 7 November 2021 @](http://thisweekin4n6.com/2021/11/07/week-45-2021/)_
_11:10_

[RSS (Really Simple Syndication) feed for comments on this post.](https://blog.didierstevens.com/2021/11/03/new-tool-cs-extract-key-py/feed/) TrackBack URI (Uniform
Resource Identifier)

### Leave a Reply (comments are moderated)

You are commenting using your WordPress.com account. ( Log Out / Change )

You are commenting using your Twitter account. ( Log Out / Change )

FYou are commenting using your Facebook account. ( Log Out / Change )

Cancel
Connecting to %s

This site uses Akismet to reduce spam. [Learn how your comment data is processed.](https://akismet.com/privacy/)


-----