Skip to main content

Cobalt Strike

Malware Family

4 981 indicators of compromise attributed to Cobalt Strike across abuse.ch threat intelligence feeds.

Domains

880

IPs

3 448

URLs

349

Hashes

304

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (880)IPs (3 448)URLs (349)Hashes (304)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
guggenheimpartners-survey.comdomain
aabancaa.comdomain
directoryupdate.netdomain
eonline-cdn.comdomain
kycdn.azure-css.comdomain
vezawahoy.comdomain
ns1.cacheflow.topdomain
youronlinesports.comdomain
ns1.nmd5.comdomain
www.eyefinancemonitor.comdomain
google.dns-1.helpdomain
sajij.comdomain
n3.google-analytcis.comdomain
tech-guard.vguard.techdomain
bartiba.comdomain
update.cdn-update.workers.devdomain
complianceportals.comdomain
deyikurihe.comdomain
yuwajeni.comdomain
ascagliarinish.comdomain
101.43.24.136ip
43.249.172.102ip
118.25.147.157ip
70.39.202.17ip
47.120.70.161ip
156.234.226.33ip
66.154.119.177ip
101.200.193.211ip
121.89.81.108ip
47.251.21.59ip
39.108.104.149ip
23.235.177.21ip
23.226.48.195ip
18.142.177.189ip
101.42.183.92ip
43.249.175.206ip
118.195.209.31ip
80.78.30.153ip
38.54.115.233ip
82.157.33.67ip
https://propertynewsclub.com/queue/Business/JFL83YMYRUHXurl
http://69.49.229.88:443/MQEwurl
https://harmonyshoused.com/design/query/9X5M3SOE0Furl
https://vip8806.mom/jquery-3.3.1.min.jsurl
http://192.168.159.136:80/jquery-3.3.2.slim.min.jsurl
https://online.cloudwebpictures.com/jquery-3.3.1.min.jsurl
https://goksearch.com/jquery-3.3.1.min.jsurl
https://pretunz.com/jquery-3.3.1.min.jsurl
http://atechniques.com/RELEASE.jsurl
http://dns.costacancordia.com:53/jpurl
https://zominoz.com/jquery-3.3.1.min.jsurl
https://realsecuritystore.com/c/msdownload/update/others/2020/10/29136388_url
https://sinergil.com/jquery-3.3.1.min.jsurl
http://103.146.231.107:80/DFneurl
https://support.whatsappsignup.com/jquery-4.8.1.min.jsurl
https://deyikurihe.com/tab_home_active.cssurl
http://666621.xyz/loadurl
https://globallookclub.com/Kill/v1.82/M2MOXIERurl
https://fazehotafa.com/ak.cssurl
https://qw.conhoosst.com/language.htmlurl

Another file to check? Run a file hash reputation check.