sample
994b05f4f96ed7421ae534fc7cf25f9b66f524f7d8d8bb6f34fa270b91a9d344
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
994b05f4f96ed7421ae534fc7cf25f9b66f524f7d8d8bb6f34fa270b91a9d344
TLP:CLEAR
Sample
sha-256994b05f4f96ed7421ae534fc7cf25f9b66f524f7d8d8bb6f34fa270b91a9d344
familyCobalt Strike
identified byfile analysis
first seen2026-09-12 21:03 UTC
last seen2026-09-12 21:03 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 8.163.59.20:8008 Cobalt Strike