2026-04-18_3dc858da9ba2d20a9aee6aadf64160e3_cobalt-strike_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-18_3dc858da9ba2d20a9aee6aadf64160e3_cobalt-strike_elex_mespinoza
Size 367KB
Sample260418-xffetadz21
SHA256 4ec22e6fd12a4aa2424912bd620aadc7839bb0f206afef42eab4b3974f247918
MD5 3dc858da9ba2d20a9aee6aadf64160e3
SHA1 913ab29c0d354025519a61856a57e911bac7a161
SHA512 c9a9615c630685264e1762d3112cebb8417cb41bf5efb25f4eb1c73feeaa9030d9b5a5d7fe9700b05d147c542177ed4cf803ecadce37d068dec61b7e304965eb
SSDEEP 6144:B82I/KsBV1lEbcWtW3NeNX5etdgw5BIMb5s:wxl2CdgkOU5s
TLSH
T18B847E02E701B0B9D82A20F1375EEB39A6740D695B124AC793C47D285E35AE11F35FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-18_3dc858da9ba2d20a9aee6aadf64160e3_cobalt-strike_elex_mespinoza

File Explorer

2026-04-18_3dc858da9ba2d20a9aee6aadf64160e3_cobalt-strike_elex_mespinoza

.exe 367KB

2026-04-18_3dc858da9ba2d20a9aee6aadf64160e3_cobalt-strike_elex_mespinoza

IMPHASH e60d3069a1c4125970edf690a85c8fba
SHA256 4ec22e6fd12a4aa2424912bd620aadc7839bb0f206afef42eab4b3974f247918
MD5 3dc858da9ba2d20a9aee6aadf64160e3
SHA1 913ab29c0d354025519a61856a57e911bac7a161
SHA512 c9a9615c630685264e1762d3112cebb8417cb41bf5efb25f4eb1c73feeaa9030d9b5a5d7fe9700b05d147c542177ed4cf803ecadce37d068dec61b7e304965eb
SSDEEP 6144:B82I/KsBV1lEbcWtW3NeNX5etdgw5BIMb5s:wxl2CdgkOU5s
TLSH
T18B847E02E701B0B9D82A20F1375EEB39A6740D695B124AC793C47D285E35AE11F35FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

182558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\builds\obj\2539b1\obj-i686-pc-mingw32\comm\suite\app\seamonkey.pdb

mozglue

?DllBlocklist_Initialize@@YAXI@Z ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z _wcsdup free malloc strdup

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread DebugBreak DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FreeEnvironmentStringsW FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileType GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetQueuedCompletionStatus GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetVolumePathNameW HeapDestroy HeapSetInformation InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenProcess PostQueuedCompletionStatus ProcessIdToSessionId QueryPerformanceCounter RaiseException ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ResetEvent SearchPathW SetDllDirectoryW SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetUnhandledExceptionFilter SignalObjectAndWait Sleep TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteProcessMemory lstrlenW

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid GetAce GetKernelObjectSecurity GetLengthSid GetSecurityDescriptorSacl GetSecurityInfo GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDisablePredefinedCache RegOpenKeyExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0ios_base@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?good@ios_base@std@@QBE_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

vcruntime140

_CxxThrowException __current_exception __current_exception_context __std_exception_copy __std_exception_destroy _except_handler3 _except_handler4_common _purecall memcmp memcpy memmove memset strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _controlfp_s _crt_atexit _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vswprintf _set_fmode _wfopen fclose fgets

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

__p__environ _putenv getenv

api-ms-win-crt-string-l1-1-0

_stricmp _strnicmp _wcsicmp _wcsnicmp strcpy strlen towupper wcscmp wcscpy_s wcslen

Name

.text

Size

176KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-18_3dc858da9ba2d20a9aee6aadf64160e3_cobalt-strike_elex_mespinoza

mozglue

kernel32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

generic