sample
21aa99831c9a7161d258068fffa7b1a437c4ae60b2101a53e8d915e0e761f33b
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
21aa99831c9a7161d258068fffa7b1a437c4ae60b2101a53e8d915e0e761f33b
TLP:CLEAR
Sample
sha-25621aa99831c9a7161d258068fffa7b1a437c4ae60b2101a53e8d915e0e761f33b
familyCobalt Strike
identified byfile analysis
first seen2026-10-08 21:04 UTC
last seen2026-10-08 21:04 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 43.138.116.60:443 Cobalt Strike