Itinerary to Defeat Yet Another Beacon Implementation
summary
Three reimplementations of Cobalt Strike beacon in Rust and Go get deep analysis: one Rust project is simple with config in plain text, another Rust project has >30 in-the-wild samples and dynamically formatted URLs, and GeaconPro (Go) yields >100 samples and a notable C2 IP 95.40.21.84. The work publishes FLIRT signatures and YARA rules, uses PCF/sigmake and IDA/Ghidra or rust strings parser, notes Rust toolchain sensitivity (e.g. Rust 1.92.0), and shows strings, signature generation, and manual reverse engineering reliably recover C2 IOCs.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:08Cobalt Strike basics
- 8:38Beacon payloads in Rust and Go
- 10:03Rust Beacon analysis
- 19:21Rust Beacon project overview
- 22:16Geacon and GeaconPro
- 27:18Emerging threats and detection
- 29:05Q&A
related talks
37mRise of the Vermilion: Cross-platform Cobalt Strike Beacon Targeting Linux and Windows
19mCounterexamples in Safe Rust
14mDFIR - Don't Forget Your Roots!
30mIntegrating Rust into Tor: Successes and Challenges
40mReverse Engineering Rust Malware in 2026
47mReverse Engineering Go Malware: From Manual to AI-Powered Analysis
01h 00mStories from NC3 - investigating hackers
05mLightning Talk: Lessons Learned from the Embedded Capture-the-Flag (eCTF) competitions