sample
38ef9a1c61efca220eb2a32a4425e5242bb2de8ea9958bf8c0bdb78d2b2d5343
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
38ef9a1c61efca220eb2a32a4425e5242bb2de8ea9958bf8c0bdb78d2b2d5343
TLP:CLEAR
Sample
sha-25638ef9a1c61efca220eb2a32a4425e5242bb2de8ea9958bf8c0bdb78d2b2d5343
familyCobalt Strike
identified byfile analysis
first seen2026-10-15 06:15 UTC
last seen2026-10-23 21:07 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 49.233.181.236:8426 Cobalt Strike