Cobalt Strike

Malware Family

4 207 indicators of compromise attributed to Cobalt Strike across abuse.ch threat intelligence feeds.

Domains

816

IPs

3 065

URLs

41

Hashes

285

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (816)IPs (3 065)URLs (41)Hashes (285)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
evil.ritademo.io.vndomain
www.microsofer.topdomain
cdn1.wakecoin.xyzdomain
ns524280.ip-192-99-232.netdomain
innovativesitecreations.comdomain
js.msedgeupdate.comdomain
youronlinesports.comdomain
out1etshops.comdomain
ruplearben.comdomain
666621.xyzdomain
freygor.comdomain
1364170351-5ezc7c8ssf.ap-guangzhou.tencentscf.comdomain
lcowpowerlite.italynorth.cloudapp.azure.comdomain
cdn-top.comdomain
google.dns-1.helpdomain
wsus2.227api.comdomain
defegh.comdomain
flyingbbird.abcdomain
www.salesf0rce.clubdomain
hadujaza.comdomain
119.29.117.194ip
182.92.83.146ip
47.121.181.148ip
47.104.163.51ip
77.74.201.243ip
23.248.213.116ip
156.234.233.161ip
117.72.39.83ip
156.234.226.61ip
156.234.56.44ip
149.255.35.131ip
156.234.216.58ip
106.13.211.192ip
154.94.233.166ip
149.104.25.77ip
38.55.99.173ip
185.89.222.133ip
23.248.213.117ip
185.107.74.40ip
23.226.56.198ip
http://85.121.148.88:42871/kunkun/jquery-3.3.1.min.jsurl
http://47.92.109.107:32251/9jPjurl
http://192.168.88.143:80/9x5wurl
http://178.16.52.201/9cca20c6df659f72/m_cpt1903.binurl
http://62.234.54.51:443/ga.jsurl
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=booksurl
http://202.56.160.190:80/HRQrurl
http://152.32.191.249:23803/YsIHurl
https://ntc-redirect.akamai-live.workers.dev/compare/v1.44/url
https://se.tsukivpn.ru:443/url
http://120.76.243.150:8899/1ujMurl
https://20.6.97.231/async/newtab_ogburl
http://110.40.181.138:14433/IIsXurl
http://192.168.2.53:80/am8Wurl
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=booksurl
https://d34auolpreyu24.cloudfront.net/jquery-3.3.1.min.jsurl
http://129.204.224.81:14226/visit.jsurl
http://58.218.215.67:443/cloud-site/header-and-footer/shopping-cart.pngurl
http://107.175.206.36:8866/1eWpurl
https://20.6.97.231/async/ddljsonurl