cs-extract-key.py

Extract AES and HMAC keys from Cobalt Strike beacon process memory.

Platforms: Linux · License: Public Domain · Last verified September 6, 2026

Extract AES and HMAC keys from Cobalt Strike beacon process memory.

Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.

Getting started

Preinstalled on REMnux. See the official REMnux tool listing and upstream website linked above for details.

Ubuntu-based toolkit for reverse-engineering and analyzing malicious software