sample
6ccb5e4a936845242f562c30fa7dca7d4cbb04ba2cc1f7e7fe0a0aa04e7042ef
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
6ccb5e4a936845242f562c30fa7dca7d4cbb04ba2cc1f7e7fe0a0aa04e7042ef
TLP:CLEAR
Sample
sha-2566ccb5e4a936845242f562c30fa7dca7d4cbb04ba2cc1f7e7fe0a0aa04e7042ef
familyCobalt Strike
identified byfile analysis
first seen2026-09-22 02:17 UTC
last seen2026-09-22 02:17 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 123.249.100.226:80 Cobalt Strike