2026-05-28_67c1f349df27b574ad27c61a95b38953_cobalt-strike_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_67c1f349df27b574ad27c61a95b38953_cobalt-strike_mespinoza
Size 974KB
Sample260528-raadqaa16w
SHA256 5044e7cd8d7cec9ee37e305316e2444af28705996a2f0a13fcb59a7679a4d9eb
MD5 67c1f349df27b574ad27c61a95b38953
SHA1 18d49a61df6e993d89a7d48fba917f578a56f880
SHA512 65bcf96d4d4221d1fdfa6df9a970f4205852b419dbfbd6a8bf5bd7aa3265ca492130d3421f0681ae733bb732ab97e6f60363b9418b9e50d4e56b45b846ee9be8
SSDEEP 12288:ET5daY+FUBkRQ9t+p71Vk4DkziivOk/HPeS5OkMO:ydD+qBkut+Rw4DkzCk/HmS5Oc
TLSH
T1C225395DFEA14DE6D9528030CCA5977EA630BD940F2086DB2258B72EEE33FD06D39611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_67c1f349df27b574ad27c61a95b38953_cobalt-strike_mespinoza

File Explorer

2026-05-28_67c1f349df27b574ad27c61a95b38953_cobalt-strike_mespinoza

.exe 974KB

2026-05-28_67c1f349df27b574ad27c61a95b38953_cobalt-strike_mespinoza

IMPHASH 65293b99407a6f5078820a90cf69e4f2
SHA256 5044e7cd8d7cec9ee37e305316e2444af28705996a2f0a13fcb59a7679a4d9eb
MD5 67c1f349df27b574ad27c61a95b38953
SHA1 18d49a61df6e993d89a7d48fba917f578a56f880
SHA512 65bcf96d4d4221d1fdfa6df9a970f4205852b419dbfbd6a8bf5bd7aa3265ca492130d3421f0681ae733bb732ab97e6f60363b9418b9e50d4e56b45b846ee9be8
SSDEEP 12288:ET5daY+FUBkRQ9t+p71Vk4DkziivOk/HPeS5OkMO:ydD+qBkut+Rw4DkzCk/HmS5Oc
TLSH
T1C225395DFEA14DE6D9528030CCA5977EA630BD940F2086DB2258B72EEE33FD06D39611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\setlang\x-none\setlang.pdb

mfc140u

ord1450 ord8084 ord11929 ord10124 ord12606 ord12544 ord4445 ord7716 ord8023 ord5183 ord2439 ord12223 ord12222 ord14210 ord7393 ord14216 ord9089 ord4011 ord3949 ord12625 ord7668 ord2011 ord11665 ord11664 ord14088 ord8167 ord7719 ord14288 ord6121 ord14290 ord6123 ord14289 ord6122 ord983 ord6614 ord3731 ord5706 ord11921 ord7920 ord11933 ord11901 ord5080 ord5363 ord5552 ord9041 ord5339 ord5555 ord5083 ord5229 ord5062 ord7460 ord7461 ord7450 ord5227 ord7922 ord9941 ord2212 ord2357 ord12212 ord8900 ord320 ord7650 ord2370

vcruntime140

__std_terminate __CxxFrameHandler3 memset __C_specific_handler __telemetry_main_invoke_trigger __telemetry_main_return_trigger __vcrt_InitializeCriticalSectionEx wcsrchr

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscpy_s _wcsicmp wcsncat_s

api-ms-win-crt-runtime-l1-1-0

_initterm _initialize_wide_environment exit _exit _cexit _initterm_e _get_wide_winmain_command_line _c_exit _register_thread_local_exe_atexit_callback _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate _seh_filter_exe _configure_wide_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _configthreadlocale

advapi32

RegGetValueW

kernel32

RaiseException LoadLibraryExA VirtualQuery GetSystemInfo FormatMessageA LocalFree LoadLibraryExW FreeLibrary GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetProcAddress GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent CloseHandle WerRegisterMemoryBlock VirtualProtect GetTickCount GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId HeapSetInformation QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection OutputDebugStringW GetLastError GetModuleHandleExW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap IsDebuggerPresent

ole32

OleInitialize CoInitializeEx CoUninitialize OleUninitialize

Name

.text

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

900B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_67c1f349df27b574ad27c61a95b38953_cobalt-strike_mespinoza

mfc140u

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

advapi32

kernel32

ole32

generic