sample
eeb0fc5595bf9e7eb302381b975b5e0bdf4b95f688fcf2fc8f2146737aba6395
A Cobalt Strike sample, identified from its own bytes without running it (a Cobalt Strike beacon stage downloaded from its listener).
eeb0fc5595bf9e7eb302381b975b5e0bdf4b95f688fcf2fc8f2146737aba6395
TLP:CLEAR
Sample
sha-256eeb0fc5595bf9e7eb302381b975b5e0bdf4b95f688fcf2fc8f2146737aba6395
familyCobalt Strike
identified byfile analysis
first seen2026-10-26 03:08 UTC
last seen2026-10-29 03:07 UTC
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 212.14.244.222:809 Cobalt Strike