sample
56f21335d73af9c0f4e844217bcb351e88e1ca3f2ea6353d1f6e8daee2d0d979
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
56f21335d73af9c0f4e844217bcb351e88e1ca3f2ea6353d1f6e8daee2d0d979
TLP:CLEAR
Sample
sha-25656f21335d73af9c0f4e844217bcb351e88e1ca3f2ea6353d1f6e8daee2d0d979
familyCobalt Strike
identified byfile analysis
first seen2026-09-22 06:02 UTC
last seen2026-09-23 03:05 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 121.43.58.113:81 Cobalt Strike