sample
da656fcf253558a29828c527ce2126649d263da6b3a8a837fe6e43db10baff4d
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
da656fcf253558a29828c527ce2126649d263da6b3a8a837fe6e43db10baff4d
TLP:CLEAR
Sample
sha-256da656fcf253558a29828c527ce2126649d263da6b3a8a837fe6e43db10baff4d
familyCobalt Strike
identified byfile analysis
first seen2026-09-21 09:16 UTC
last seen2026-09-21 09:16 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 106.54.201.103:9999 Cobalt Strike