Signatured by Default

How to drop to disk part 2 :D

Context

I will only be using 2 hosts for the rest of this blog (because I'm lazy) which is a Kali VM hosting the Cobalt Strike teamserver with the default malleable C2 profile, and my Windows 10 Host PC.

We will only have 1 listener over HTTP.

Dropping to Disk

The dropped payload is a Windows Stageless PE x64

As expected, the default cobalt beacon is also heavily signatured.

Customization

Instead of trying to patch the heavily signatured cobalt beacon to evade anti-virus, we're going to make our own custom dropper that will inject the cobalt beacon shellcode!

A well-made dropper with OPSEC considerations will likely evade static analysis.