Skip to main content

Cobalt Strike

Malware Family

4 913 indicators of compromise attributed to Cobalt Strike across abuse.ch threat intelligence feeds.

Domains

877

IPs

3 392

URLs

348

Hashes

296

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (877)IPs (3 392)URLs (348)Hashes (296)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
sunwu.worlddomain
afspd.comdomain
onemusicllc.comdomain
usadevgroup.comdomain
ppew.audomain
arvosash.comdomain
volsecure.comdomain
activeservers.netdomain
kl.kimlinlin.comdomain
login.onemusic24.comdomain
www.eyefinancemonitor.comdomain
furfen.comdomain
pt-security.rudomain
bxx2rghe05kng.cfc-execute.bj.baidubce.comdomain
bornometa.comdomain
unzip2.xyzdomain
ieee-ecce.infodomain
clacem.comdomain
178-128-196-79.sslip.iodomain
exchangeallltd.comdomain
49.233.215.164ip
164.92.70.225ip
193.187.101.68ip
47.254.68.68ip
187.52.119.59ip
182.254.155.23ip
118.31.18.77ip
156.234.21.214ip
47.121.27.21ip
179.43.190.13ip
103.41.7.143ip
107.149.123.161ip
45.140.213.6ip
123.56.124.3ip
185.89.78.223ip
47.242.248.156ip
47.119.178.247ip
156.234.67.19ip
23.248.213.99ip
43.249.172.124ip
https://postofficeltdc.com/nvurl
https://allgroupservices.com/linksurl
https://aigouing.com/pushurl
https://cocesovo.com/defaulturl
https://vip8806.mom/jquery-3.3.1.min.jsurl
https://newstamagavk.com/register/v9.51/M9F9POS98Q84url
http://ngrety.com/jquery-3.3.1.min.jsurl
https://vpnupdaters.com/admin.cssurl
https://duckducklive.top:8443/functionalStatus/fDLridgHMu-3IxnJCWNllcZnbqLnn8fyburl
https://www.hellomrsone.com/jquery-3.3.1.min.jsurl
https://telemetrin.com/faviconurl
https://agazud.com/jquery-3.3.1.min.jsurl
https://chitozx.com/jquery-3.3.1.min.jsurl
https://sprinthunter.com/matchurl
https://www.service1app.com/Disable/daily/W578UC8WIJQurl
http://jacketsupport.com/form/dbm/VO5K8LXBOZurl
https://sezezapa.com/tab_shop_active.htmlurl
https://harborfreight.delivery/en-us/p/book-2/8MCPZJJCC98Curl
https://anbush.com/jquery-3.3.1.min.jsurl
http://202.56.160.190:80/HRQrurl

Another file to check? Run a file hash reputation check.