sample
3c97aa53e7e18643c2dbf6d0310e4d3969457c30564b7a5f3954b44d8569f944
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
3c97aa53e7e18643c2dbf6d0310e4d3969457c30564b7a5f3954b44d8569f944
TLP:CLEAR
Sample
sha-2563c97aa53e7e18643c2dbf6d0310e4d3969457c30564b7a5f3954b44d8569f944
familyCobalt Strike
identified byfile analysis
first seen2026-09-18 15:20 UTC
last seen2026-10-11 04:10 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 156.239.252.191:448 Cobalt Strike