sample
2a9a45f837d39561b1b56bb7e39070dcc845b23cd4a3f9dedb34f6387ce02478
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
2a9a45f837d39561b1b56bb7e39070dcc845b23cd4a3f9dedb34f6387ce02478
TLP:CLEAR
Sample
sha-2562a9a45f837d39561b1b56bb7e39070dcc845b23cd4a3f9dedb34f6387ce02478
familyCobalt Strike
identified byfile analysis
first seen2026-09-25 06:30 UTC
last seen2026-10-30 15:10 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 82.156.186.185:18443 Cobalt Strike