sample
532d59a9c32cbef58697bfe8a30b7f1f79b568528359fc9dcd1ffc38b3f6a89a
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
532d59a9c32cbef58697bfe8a30b7f1f79b568528359fc9dcd1ffc38b3f6a89a
TLP:CLEAR
Sample
sha-256532d59a9c32cbef58697bfe8a30b7f1f79b568528359fc9dcd1ffc38b3f6a89a
familyCobalt Strike
identified byfile analysis
first seen2026-10-05 03:10 UTC
last seen2026-10-05 03:10 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 85.11.182.104:443 Cobalt Strike