sample
1f5bfb5255e5ac20a35061458e9fc436531fb6109f19ab3f8c8a57f3b1acc2e0
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
1f5bfb5255e5ac20a35061458e9fc436531fb6109f19ab3f8c8a57f3b1acc2e0
TLP:CLEAR
Sample
sha-2561f5bfb5255e5ac20a35061458e9fc436531fb6109f19ab3f8c8a57f3b1acc2e0
familyCobalt Strike
identified byfile analysis
first seen2026-10-25 06:13 UTC
last seen2026-10-28 21:07 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 192.255.248.153:80 Cobalt Strike