sample
0e9cf9f997b6ef09a271e24d6620a6a4a080c1f59a5b652ce91a12918f23225d
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
0e9cf9f997b6ef09a271e24d6620a6a4a080c1f59a5b652ce91a12918f23225d
TLP:CLEAR
Sample
sha-2560e9cf9f997b6ef09a271e24d6620a6a4a080c1f59a5b652ce91a12918f23225d
familyCobalt Strike
identified byfile analysis
first seen2026-09-17 06:08 UTC
last seen2026-10-30 15:09 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 38.76.183.197:8806 Cobalt Strike