sample
1a7947afa7f821081187675eca39d2d938b4e54b58b2a9e26ab43e7345af8276
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
1a7947afa7f821081187675eca39d2d938b4e54b58b2a9e26ab43e7345af8276
TLP:CLEAR
Sample
sha-2561a7947afa7f821081187675eca39d2d938b4e54b58b2a9e26ab43e7345af8276
familyCobalt Strike
identified byfile analysis
first seen2026-10-09 15:07 UTC
last seen2026-10-09 15:07 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 120.76.143.184:8899 Cobalt Strike