sample
2ef95603d0d0ffec8fc7451c5040e67840c47fade0ef84ef0177ebb0f7c557bb
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
2ef95603d0d0ffec8fc7451c5040e67840c47fade0ef84ef0177ebb0f7c557bb
TLP:CLEAR
Sample
sha-2562ef95603d0d0ffec8fc7451c5040e67840c47fade0ef84ef0177ebb0f7c557bb
familyCobalt Strike
identified byfile analysis
first seen2026-09-20 07:32 UTC
last seen2026-10-30 15:09 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 183.60.226.2:38080 Cobalt Strike