Beacon version identification
dissect.cobaltstrike.version can identify the version of a Cobalt Strike beacon based on the PE export timestamp.
The following table lists the PE export timestamp and the corresponding Cobalt Strike version that have been collected and identified in the wild.
Export Stamp |
Hex |
PE Export Date |
Cobalt Strike version |
|---|---|---|---|
1733168407 |
0x674e0d17 |
Mon Dec 02 19:40:07 2024 |
Cobalt Strike 4.10.1 (Dec 10, 2024) |
1733168403 |
0x674e0d13 |
Mon Dec 02 19:40:03 2024 |
Cobalt Strike 4.10.1 (Dec 10, 2024) |
1733168386 |
0x674e0d02 |
Mon Dec 02 19:39:46 2024 |
Cobalt Strike 4.10.1 (Dec 10, 2024) |
1720799271 |
0x66915027 |
Fri Jul 12 15:47:51 2024 |
Cobalt Strike 4.10 (Jul 16, 2024) |
1720799268 |
0x66915024 |
Fri Jul 12 15:47:48 2024 |
Cobalt Strike 4.10 (Jul 16, 2024) |
1720799266 |
0x66915022 |
Fri Jul 12 15:47:46 2024 |
Cobalt Strike 4.10 (Jul 16, 2024) |
1720799264 |
0x66915020 |
Fri Jul 12 15:47:44 2024 |
Cobalt Strike 4.10 (Jul 16, 2024) |
1720799247 |
0x6691500f |
Fri Jul 12 15:47:27 2024 |
Cobalt Strike 4.10 (Jul 16, 2024) |
1694010590 |
0x64f88cde |
Wed Sep 06 14:29:50 2023 |
Cobalt Strike 4.9 (Sep 19, 2023) |
1694010526 |
0x64f88c9e |
Wed Sep 06 14:28:46 2023 |
Cobalt Strike 4.9 (Sep 19, 2023) |
1694010494 |
0x64f88c7e |
Wed Sep 06 14:28:14 2023 |
Cobalt Strike 4.9 (Sep 19, 2023) |
1694010462 |
0x64f88c5e |
Wed Sep 06 14:27:42 2023 |
Cobalt Strike 4.9 (Sep 19, 2023) |
1676543367 |
0x63ee0587 |
Thu Feb 16 10:29:27 2023 |
Cobalt Strike 4.8 (Feb 28, 2023) |
1676543340 |
0x63ee056c |
Thu Feb 16 10:29:00 2023 |
Cobalt Strike 4.8 (Feb 28, 2023) |
1676543314 |
0x63ee0552 |
Thu Feb 16 10:28:34 2023 |
Cobalt Strike 4.8 (Feb 28, 2023) |
1661785433 |
0x630cd559 |
Mon Aug 29 15:03:53 2022 |
Cobalt Strike 4.7.1 (Sep 16, 2022) |
1661785403 |
0x630cd53b |
Mon Aug 29 15:03:23 2022 |
Cobalt Strike 4.7.1 (Sep 16, 2022) |
1661785372 |
0x630cd51c |
Mon Aug 29 15:02:52 2022 |
Cobalt Strike 4.7.1 (Sep 16, 2022) |
1659630329 |
0x62ebf2f9 |
Thu Aug 04 16:25:29 2022 |
Cobalt Strike 4.7 (Aug 17, 2022) |
1659630298 |
0x62ebf2da |
Thu Aug 04 16:24:58 2022 |
Cobalt Strike 4.7 (Aug 17, 2022) |
1659630264 |
0x62ebf2b8 |
Thu Aug 04 16:24:24 2022 |
Cobalt Strike 4.7 (Aug 17, 2022) |
1649798033 |
0x6255eb91 |
Tue Apr 12 21:13:53 2022 |
Cobalt Strike 4.6 (Apr 12, 2022) |
1649797998 |
0x6255eb6e |
Tue Apr 12 21:13:18 2022 |
Cobalt Strike 4.6 (Apr 12, 2022) |
1649797966 |
0x6255eb4e |
Tue Apr 12 21:12:46 2022 |
Cobalt Strike 4.6 (Apr 12, 2022) |
1637694016 |
0x619d3a40 |
Tue Nov 23 19:00:16 2021 |
Cobalt Strike 4.5 (Dec 14, 2021) |
1637693979 |
0x619d3a1b |
Tue Nov 23 18:59:39 2021 |
Cobalt Strike 4.5 (Dec 14, 2021) |
1627994782 |
0x61093a9e |
Tue Aug 03 12:46:22 2021 |
Cobalt Strike 4.4 (Aug 04, 2021) |
1627994693 |
0x61093a45 |
Tue Aug 03 12:44:53 2021 |
Cobalt Strike 4.4 (Aug 04, 2021) |
1614781725 |
0x603f9d1d |
Wed Mar 03 14:28:45 2021 |
Cobalt Strike 4.3 (Mar 03, 2021) |
1614696183 |
0x603e4ef7 |
Tue Mar 02 14:43:03 2021 |
Cobalt Strike 4.3 (Mar 03, 2021) |
1614687645 |
0x603e2d9d |
Tue Mar 02 12:20:45 2021 |
Cobalt Strike 4.3 (Mar 03, 2021) |
1604366948 |
0x5fa0b264 |
Tue Nov 03 01:29:08 2020 |
Cobalt Strike 4.2 (Nov 06, 2020) |
1604366849 |
0x5fa0b201 |
Tue Nov 03 01:27:29 2020 |
Cobalt Strike 4.2 (Nov 06, 2020) |
1603584534 |
0x5f94c216 |
Sun Oct 25 00:08:54 2020 |
Cobalt Strike 4.2 (Nov 06, 2020) |
1592939923 |
0x5ef25593 |
Tue Jun 23 19:18:43 2020 |
Cobalt Strike 4.1 (Jun 25, 2020) |
1592939867 |
0x5ef2555b |
Tue Jun 23 19:17:47 2020 |
Cobalt Strike 4.1 (Jun 25, 2020) |
1575547386 |
0x5de8f1fa |
Thu Dec 05 12:03:06 2019 |
Cobalt Strike 4.0 (Dec 05, 2019) |
1575547248 |
0x5de8f170 |
Thu Dec 05 12:00:48 2019 |
Cobalt Strike 4.0 (Dec 05, 2019) |
1575497188 |
0x5de82de4 |
Wed Dec 04 22:06:28 2019 |
Cobalt Strike 4.0 (Dec 05, 2019) |
1569306883 |
0x5d89b903 |
Tue Sep 24 06:34:43 2019 |
Cobalt Strike 4.0 (Dec 05, 2019) |
1556924433 |
0x5cccc811 |
Fri May 03 23:00:33 2019 |
Cobalt Strike 3.14 (May 04, 2019) |
1555631605 |
0x5cb90df5 |
Thu Apr 18 23:53:25 2019 |
Cobalt Strike 3.14 (May 02, 2019) |
1546037702 |
0x5c26a9c6 |
Fri Dec 28 22:55:02 2018 |
Cobalt Strike 3.13 (Jan 02, 2019) |
1536184396 |
0x5b90504c |
Wed Sep 05 21:53:16 2018 |
Cobalt Strike 3.12 (Sep 06, 2018) |
1527022389 |
0x5b048335 |
Tue May 22 20:53:09 2018 |
Cobalt Strike 3.11 (May 24, 2018) |
1523134121 |
0x5ac92ea9 |
Sat Apr 07 20:48:41 2018 |
Cobalt Strike 3.11 (Apr 09, 2018) |
1512682653 |
0x5a29b49d |
Thu Dec 07 21:37:33 2017 |
Cobalt Strike 3.10 (Dec 11, 2017) |
1505657962 |
0x59be846a |
Sun Sep 17 14:19:22 2017 |
Cobalt Strike 3.9 (Sep 26, 2017) |
1495488077 |
0x5923564d |
Mon May 22 21:21:17 2017 |
Cobalt Strike 3.8 (May 23, 2017) |
1488758730 |
0x58bca7ca |
Mon Mar 06 00:05:30 2017 |
Cobalt Strike 3.7 (Mar 15, 2017) |
1481145921 |
0x58487e41 |
Wed Dec 07 21:25:21 2016 |
Cobalt Strike 3.6 (Dec 08, 2016) |
1474078204 |
0x57dca5fc |
Sat Sep 17 02:10:04 2016 |
Cobalt Strike 3.5 (Sep 22, 2016) |
1469737033 |
0x579a6849 |
Thu Jul 28 20:17:13 2016 |
Cobalt Strike 3.4 (Jul 29, 2016) |
Use the beacon-dump command to identify the version of a Cobalt Strike beacon.
Use the -v flag to print extra information, including the PE export timestamp and the version of the beacon.
$ beacon-dump -v beacon.bin
--------------------------------------------------
pe_export_stamp = 1720799264, 0x66915020, Fri Jul 12 17:47:44 2024 - Cobalt Strike 4.10 (Jul 16, 2024)
pe_compile_stamp = 1478837312, 0x58254440, Fri Nov 11 05:08:32 2016
max_setting_enum = 78 - BeaconSetting.SETTING_BEACON_GATE
beacon_version = Cobalt Strike 4.10 (Jul 16, 2024)
If the version is unknown, the beacon-dump command will print the PE export timestamp and the version Unknown.
A GitHub issue is welcome to add the PE export timestamp and the corresponding Cobalt Strike version to the table.