sample
6e7e09a69b358b0e56a7fe3d8e2317f82d3cc1ed30c067de9d1db6540c9cecc2
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
6e7e09a69b358b0e56a7fe3d8e2317f82d3cc1ed30c067de9d1db6540c9cecc2
TLP:CLEAR
Sample
sha-2566e7e09a69b358b0e56a7fe3d8e2317f82d3cc1ed30c067de9d1db6540c9cecc2
familyCobalt Strike
identified byfile analysis
first seen2026-09-10 19:11 UTC
last seen2026-09-12 04:42 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 209.200.246.194:37865 Cobalt Strike