# An Obfuscated Beacon – Extra XOR Layer

**[videos.didierstevens.com/2022/09/06/an-obfuscated-beacon-extra-xor-layer/](https://videos.didierstevens.com/2022/09/06/an-obfuscated-beacon-extra-xor-layer/)**

Tools: [1768.py,](https://blog.didierstevens.com/programs/cobalt-strike-tools/) [xor-kpa.py,](https://blog.didierstevens.com/2022/09/06/update-xor-kpa-py-version-0-0-6/) [pecheck.py,](https://blog.didierstevens.com/2022/05/26/update-pecheck-py-version-0-7-15/) [translate.py,](https://blog.didierstevens.com/programs/translate/) [strings.py](https://blog.didierstevens.com/2021/01/24/update-strings-py-version-0-0-7/)

Diary entry: [Analysis of an Encoded Cobalt Strike Beacon](https://isc.sans.edu/diary/Analysis+of+an+Encoded+Cobalt+Strike+Beacon/29014)


September 6, 2022


[Sample: e652ee076aded6b2c8b4e3e8ee83ed9423019d0a9aacbd38837d251191972bef](https://www.virustotal.com/gui/file/e652ee076aded6b2c8b4e3e8ee83ed9423019d0a9aacbd38837d251191972bef)


-----

Watch Video At:


https://youtu.be/pCNYvgh_OuQ


-----