sample
6aa1a587f25ceb66b4c026c4ca6e33d33850bb384f12df5c882f3d2027be2cc5
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
6aa1a587f25ceb66b4c026c4ca6e33d33850bb384f12df5c882f3d2027be2cc5
TLP:CLEAR
Sample
sha-2566aa1a587f25ceb66b4c026c4ca6e33d33850bb384f12df5c882f3d2027be2cc5
familyCobalt Strike
identified byfile analysis
first seen2026-09-11 14:00 UTC
last seen2026-09-14 10:23 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 124.222.28.189:54325 Cobalt Strike