sample
aa4e2413cc8050ccb7e35b75d15d6890f310076b80ad2cc4e92c005812f59b1e
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
aa4e2413cc8050ccb7e35b75d15d6890f310076b80ad2cc4e92c005812f59b1e
TLP:CLEAR
Sample
sha-256aa4e2413cc8050ccb7e35b75d15d6890f310076b80ad2cc4e92c005812f59b1e
familyCobalt Strike
identified byfile analysis
first seen2026-10-27 06:19 UTC
last seen2026-10-30 15:10 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 111.170.148.141:8099 Cobalt Strike