2025-10-01_d5c9ac22307425916e131c46b6814ed7_cobalt-strike_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2025-10-01_d5c9ac22307425916e131c46b6814ed7_cobalt-strike_mespinoza_njrat_ryuk
Size 684KB
Sample251002-aad88sen3y
SHA256 219ce6a00a3a5c8fae48228a0aa40f9cd2fa7277d0f1c274191f6631b1241ad1
MD5 d5c9ac22307425916e131c46b6814ed7
SHA1 7c3dec2cb27672935d38479fd82b8a32268299b9
SHA512 6054adfe7cc4a672907055e7b5812877e618390fad974aad784f3288dd31b0530557d5eea82c33029c88fc76e633f3dd479359573128e44feee61f475ce946f4
SSDEEP 12288:yF2D/15nn4loPs95M3EmfOAB2b2o82afkc6cxF:U2pwoXEmfVB2b2UKkc6cxF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-10-01_d5c9ac22307425916e131c46b6814ed7_cobalt-strike_mespinoza_njrat_ryuk

File Explorer

2025-10-01_d5c9ac22307425916e131c46b6814ed7_cobalt-strike_mespinoza_njrat_ryuk

.exe 684KB

2025-10-01_d5c9ac22307425916e131c46b6814ed7_cobalt-strike_mespinoza_njrat_ryuk

IMPHASH aabb8d8546c747d26854be7c406b8f4b
SHA256 219ce6a00a3a5c8fae48228a0aa40f9cd2fa7277d0f1c274191f6631b1241ad1
MD5 d5c9ac22307425916e131c46b6814ed7
SHA1 7c3dec2cb27672935d38479fd82b8a32268299b9
SHA512 6054adfe7cc4a672907055e7b5812877e618390fad974aad784f3288dd31b0530557d5eea82c33029c88fc76e633f3dd479359573128e44feee61f475ce946f4
SSDEEP 12288:yF2D/15nn4loPs95M3EmfOAB2b2o82afkc6cxF:U2pwoXEmfVB2b2UKkc6cxF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

283104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\b\c\b\win64_clang\src\out\Release_x64\notification_helper.exe.pdb

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

user32

AllowSetForegroundWindow

kernel32

AcquireSRWLockExclusive CloseHandle CreateDirectoryW CreateEventW CreateFileW CreateNamedPipeW CreateProcessW CreateThread DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleCP GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetVersion GetVersionExW GetWindowsDirectoryW HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ReplaceFileW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetLastError SetNamedPipeHandleState SetStdHandle SetUnhandledExceptionFilter Sleep SleepEx SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW

ole32

CoAddRefServerProcess CoRegisterClassObject CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoTaskMemFree

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shlwapi

PathMatchSpecW

winmm

timeGetTime

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

Name

.text

Size

401KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2025-10-01_d5c9ac22307425916e131c46b6814ed7_cobalt-strike_mespinoza_njrat_ryuk

api-ms-win-core-winrt-error-l1-1-0

shell32

user32

kernel32

ole32

version

shlwapi

winmm

advapi32

generic