2026-05-11_7145d25aec9adce86ed6e43e681a89b1_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_7145d25aec9adce86ed6e43e681a89b1_cobalt-strike_mespinoza_satacom
Size 597KB
Sample260511-d9vxtaes5p
SHA256 72eb5f58e361183fc6c7f0bb680302458e7c8f5b139d49db79670355eaa48b28
MD5 7145d25aec9adce86ed6e43e681a89b1
SHA1 1085a4fe68ddc900419b64956cd34db25dc75758
SHA512 7405a22a0abd9ed93f01212be71de98e9c98c198c4f32da8cdc24e51375f4647bb07f3af8e36a92e210bf3f58a9d78ff6ea37006982265c673cafc04db6653bb
SSDEEP 12288:uOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:uOfJ4yL/tNCJPXUQrPF
TLSH
T108D422AB25819189CD56C3BC4684E000C715BDC5173BA2EBDF43648A3FFDAEA6A7C351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_7145d25aec9adce86ed6e43e681a89b1_cobalt-strike_mespinoza_satacom

File Explorer

2026-05-11_7145d25aec9adce86ed6e43e681a89b1_cobalt-strike_mespinoza_satacom

.exe 597KB

2026-05-11_7145d25aec9adce86ed6e43e681a89b1_cobalt-strike_mespinoza_satacom

IMPHASH c07e1d92e4325a34a3d8c404cbc4c35a
SHA256 72eb5f58e361183fc6c7f0bb680302458e7c8f5b139d49db79670355eaa48b28
MD5 7145d25aec9adce86ed6e43e681a89b1
SHA1 1085a4fe68ddc900419b64956cd34db25dc75758
SHA512 7405a22a0abd9ed93f01212be71de98e9c98c198c4f32da8cdc24e51375f4647bb07f3af8e36a92e210bf3f58a9d78ff6ea37006982265c673cafc04db6653bb
SSDEEP 12288:uOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:uOfJ4yL/tNCJPXUQrPF
TLSH
T108D422AB25819189CD56C3BC4684E000C715BDC5173BA2EBDF43648A3FFDAEA6A7C351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\devops\workspace\ScreenShot\Output\BinRelease-x64\QQScreenshot.pdb

kernel32

AcquireSRWLockExclusive DecodePointer DeleteCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleW GetProcessHeap GetStartupInfoW GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent OutputDebugStringW QueryPerformanceCounter ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEnvironmentVariableW SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess UnhandledExceptionFilter WakeAllConditionVariable

user32

UnregisterClassW

gf

?SetCustomObjectFactory@GF@Util@@YAXP6AHAEBU_GUID@@0PEAPEAX@Z@Z ?SetDPIAdaptFlag@DPI@GF@Util@@YAXH@Z

asynctask

??0Lock@AsyncTask@@QEAA@XZ ??0MessageLoopForUI@AsyncTask@@QEAA@XZ ??0Thread@AsyncTask@@QEAA@PEBD@Z ??1Lock@AsyncTask@@QEAA@XZ ??1MessageLoop@AsyncTask@@UEAA@XZ ??1Thread@AsyncTask@@UEAA@XZ ?Acquire@Lock@AsyncTask@@QEAAXXZ ?AddObserver@MessageLoopForUI@AsyncTask@@QEAAXPEAVObserver@MessagePumpWin@2@@Z ?AssertAcquired@Lock@AsyncTask@@QEBAXXZ ?CleanUp@Thread@AsyncTask@@MEAAXXZ ?CleanUpAfterMessageLoopDestruction@Thread@AsyncTask@@MEAAXXZ ?Init@Thread@AsyncTask@@MEAAXXZ ?RegisterCallback@AtExitManager@AsyncTask@@SAXP6AXPEAX@Z0@Z ?Release@Lock@AsyncTask@@QEAAXXZ ?Run@MessageLoopForUI@AsyncTask@@QEAAXXZ ?Run@Thread@AsyncTask@@MEAAXPEAVMessageLoop@2@@Z ?RunAllPending@MessageLoop@AsyncTask@@QEAAXXZ ?SetWorkerFactory@MessageLoop@AsyncTask@@QEAAXPEAVWorkerFactory@12@@Z ?StartWithOptions@Thread@AsyncTask@@QEAA_NAEBUOptions@12@@Z ?Stop@Thread@AsyncTask@@QEAAXXZ ?ThreadMain@Thread@AsyncTask@@EEAAXXZ ?message_loop@Thread@AsyncTask@@QEBAPEAVMessageLoop@2@XZ ?thread_id@Thread@AsyncTask@@QEBAKXZ

common

??0CTXBSTR@@QEAA@AEBVCTXStringW@@@Z ??0CTXBSTR@@QEAA@PEB_W@Z ??0CTXStringW@@QEAA@PEA_W@Z ??1CTXBSTR@@QEAA@XZ ??1CTXStringW@@QEAA@XZ ??BCTXBSTR@@QEBAPEA_WXZ ??BCTXStringW@@QEBAPEB_WXZ ??H@YA?AVCTXStringW@@AEBV0@PEB_W@Z ??H@YA?AVCTXStringW@@_WAEBV0@@Z ?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PEB_W1HHH@Z ?ClearDeadQueue@Misc@Util@@YAXXZ ?CreateObjectFromDllFile@Com@Util@@YAJPEB_WAEBU_GUID@@1PEAPEAXPEAUIUnknown@@@Z ?FlushLog@TXLog@@YAXXZ ?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ ?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z ?GetPlatformCore@Core@Util@@YAHPEAPEAUITXCore@@@Z ?InitPlatform@CoreCenter@Util@@YAHPEA_W@Z ?InitPlatformCoreConfig@Boot@Util@@YAHXZ ?InitPlatformFileSystem@Boot@Util@@YAHXZ ?InitPlatformGFConfig@Boot@Util@@YAHXZ ?InitPlatformI18NConfig@Boot@Util@@YAHXZ ?OnExitCoreCenter@Misc@Util@@YAXXZ ?OnExitWinMain@Misc@Util@@YAXXZ ?OnUninitCom@Misc@Util@@YAXXZ ?SetMainAndLogicMsgLoop@Misc@Util@@YAXPEAVMessageLoopForUI@AsyncTask@@PEAVMessageLoop@4@@Z ?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z ?TXLog_DoTXLogVW@@YAXPEAUtagLogObj@@PEB_W1PEAD@Z

camera

?Destroy@IPCService@@QEAAXXZ ?GetGlobalDataUsersDir@Sys@Util@@YA?AVCTXStringW@@XZ ?GetInstance@IPCService@@SAPEAV1@XZ ?Init@IPCService@@QEAA_NXZ

ole32

OleInitialize OleUninitialize

comctl32

InitCommonControlsEx

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate memcpy memset

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_wide_winmain_command_line _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_7145d25aec9adce86ed6e43e681a89b1_cobalt-strike_mespinoza_satacom

kernel32

user32

gf

asynctask

common

camera

ole32

comctl32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic