sample
d7a787676fb4755f8f10e7967a28ec0bcff45679078e8f620f4ce3401604dab8
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
d7a787676fb4755f8f10e7967a28ec0bcff45679078e8f620f4ce3401604dab8
TLP:CLEAR
Sample
sha-256d7a787676fb4755f8f10e7967a28ec0bcff45679078e8f620f4ce3401604dab8
familyCobalt Strike
identified byfile analysis
first seen2026-10-21 06:06 UTC
last seen2026-10-26 09:05 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 103.236.84.103:6443 Cobalt Strike