sample
ec41a7d46333efb0df6599d270980b4264f076b0168f384812a67bfa6551221b
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
ec41a7d46333efb0df6599d270980b4264f076b0168f384812a67bfa6551221b
TLP:CLEAR
Sample
sha-256ec41a7d46333efb0df6599d270980b4264f076b0168f384812a67bfa6551221b
familyCobalt Strike
identified byfile analysis
first seen2026-09-20 06:53 UTC
last seen2026-09-28 06:03 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 106.54.201.103:9999 Cobalt Strike