sample
cfe51fa5d866bcb0de166c60ce1dfb92eb1d0e4502dd41570e58545ab2d777db
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
cfe51fa5d866bcb0de166c60ce1dfb92eb1d0e4502dd41570e58545ab2d777db
TLP:CLEAR
Sample
sha-256cfe51fa5d866bcb0de166c60ce1dfb92eb1d0e4502dd41570e58545ab2d777db
familyCobalt Strike
identified byfile analysis
first seen2026-10-23 15:04 UTC
last seen2026-10-23 15:04 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 101.200.193.211:8086 Cobalt Strike