I found 6 private keys used by malicious Cobalt Strike servers. There’s a significant number of malicious CS servers on the Internet that reuse these keys, thus allowing us to decrypt their C2 traffic. For the details, I recommend reading the following blog post I wrote “Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1“.
I integrated these keys in the database (1768.json) of my tool 1768.py (starting version 0.0.8).
Whenever you analyze a beacon with 1768.py that uses a public key with a known private key, the report will point this out:
And when you use option verbose, the private key will be included:
If you want to integrated these 6 keys in your own tools: be my guest. You can find these key pairs in 1768.json.
Didier Stevens 
[…] Didier Stevens“Public” Private Cobalt Strike Keys […]
Pingback by Week 43 – 2021 – This Week In 4n6 — Sunday 24 October 2021 @ 11:10
[…] Tools: cs-decrypt-metadata.py, cs-parse-http-traffic.py, 1768.py […]
Pingback by Cobalt Strike: Decrypting C2 Traffic With A “Leaked” Private Key – Didier Stevens Videos — Sunday 31 October 2021 @ 15:57