sample
009c1c639210c526e3be81dc623c15139bc99c58f9b46e5fcb6e969d7d14886b
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
009c1c639210c526e3be81dc623c15139bc99c58f9b46e5fcb6e969d7d14886b
TLP:CLEAR
Sample
sha-256009c1c639210c526e3be81dc623c15139bc99c58f9b46e5fcb6e969d7d14886b
familyCobalt Strike
identified byfile analysis
first seen2026-09-20 14:59 UTC
last seen2026-10-08 09:06 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 46.151.182.190:4443 Cobalt Strike