104.197.142[.]19IP address
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 4 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Extracting Cobalt Strike Beacon Configurations“…c946fc5 | SHA256 | Cobalt Strike Malleable C2 beacon payload clevelandclinic.cloud | domain-name | Cobalt Strike Malleable C2 domain 104.197.142[.]19 | ipv4-addr | Cobalt Strike Malleable C2 IP address 192.64.119.19 | ipv4-addr | Cobalt Strike Malleable C2 IP address”
Indicators reported together
named in the same reports- clevelandclinic[.]cloudin 1 report
- 222b8f27dbdfba8ddd559eeca27ea648in 1 report
- 7af9c759ac78da92…b30b00a8a858in 1 report
- hxxps://verify.cobaltstrike[.]comin 1 report
- verify.cobaltstrike[.]comin 1 report
- 697fddfc51958287…98c4456a3f89in 1 report
- 7475a6c08fa90e7a…a87a43ac7ac4in 1 report
- f9b38c422a89d73e…45183c946fc5in 1 report
- 192.64.119[.]19in 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.