2026-07-09_f6a687d03b69b71b4d5dacdd6114bae2_cobalt-strike_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_f6a687d03b69b71b4d5dacdd6114bae2_cobalt-strike_mespinoza
Size 1.2MB
Sample260709-g3vv1set5v
SHA256 e835329471fb7ff14efb6dea7e5af60e54cb38f4615acc9fc4fbea17b972ce0d
MD5 f6a687d03b69b71b4d5dacdd6114bae2
SHA1 773bdd4d683a334f8a378714451e6aeed58329e7
SHA512 d6d4b07bab1bf3f3a4414bdcd5e5286bff62f6c8d6a99c7aee1fd1f3842089975c3c9b2e2721176e1c34ac3712bb1b287586cbf2e72735791490cd38cb54b5da
SSDEEP 24576:PvJHjtgiqp9bgxVBIOEIAj86wpemIwpelO0lpPdHr9JTixKFy06IfWB:PvJHjCiqp9bAJKGpeapelHpPDJTikFto
TLSH
T13D45D003F38516F9E0CAE5B89A47D233A5723C440B5061DB1BA67F3A3E75AD02B79718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_f6a687d03b69b71b4d5dacdd6114bae2_cobalt-strike_mespinoza

File Explorer

2026-07-09_f6a687d03b69b71b4d5dacdd6114bae2_cobalt-strike_mespinoza

.exe 1.2MB

2026-07-09_f6a687d03b69b71b4d5dacdd6114bae2_cobalt-strike_mespinoza

IMPHASH 31816bb37b906266874b4fc9befa2749
SHA256 e835329471fb7ff14efb6dea7e5af60e54cb38f4615acc9fc4fbea17b972ce0d
MD5 f6a687d03b69b71b4d5dacdd6114bae2
SHA1 773bdd4d683a334f8a378714451e6aeed58329e7
SHA512 d6d4b07bab1bf3f3a4414bdcd5e5286bff62f6c8d6a99c7aee1fd1f3842089975c3c9b2e2721176e1c34ac3712bb1b287586cbf2e72735791490cd38cb54b5da
SSDEEP 24576:PvJHjtgiqp9bgxVBIOEIAj86wpemIwpelO0lpPdHr9JTixKFy06IfWB:PvJHjCiqp9bAJKGpeapelHpPDJTikFto
TLSH
T13D45D003F38516F9E0CAE5B89A47D233A5723C440B5061DB1BA67F3A3E75AD02B79718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

197952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

firefox.pdb

mozglue

??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AEBV?$ProfilerStringView@D@1@AEBVMarkerCategory@1@$$QEAVMarkerOptions@1@UTextMarker@markers@01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0PrintfTarget@mozilla@@IEAA@XZ ??1MutexImpl@detail@mozilla@@QEAA@XZ ??2@YAPEAX_K@Z ??3@YAXPEAX@Z ??3@YAXPEAX_K@Z ??GTimeStampValue@mozilla@@QEBA_KAEBV01@@Z ??_U@YAPEAX_K@Z ??_V@YAXPEAX@Z ?BeginProcessRuntimeInit@detail@mscom@mozilla@@YAAEAW4ProcessInitState@123@XZ ?CleanupProcessRuntime@mozilla@@YAXXZ ?CreateAndStorePreXULSkeletonUI@mozilla@@YAXPEAUHINSTANCE__@@HPEAPEAD@Z ?DllBlocklist_Initialize@@YAXI@Z ?DllBlocklist_SetBasicDllServices@@YAXPEAVDllServicesBase@detail@glue@mozilla@@@Z ?DllBlocklist_SetFullDllServices@@YAXPEAVDllServicesBase@detail@glue@mozilla@@@Z ?EndProcessRuntimeInit@detail@mscom@mozilla@@YAXXZ ?GetProfilingStack@AutoProfilerLabel@baseprofiler@mozilla@@SAPEAVProfilingStack@23@XZ ?IsActiveAndUnpaused@RacyFeatures@detail@baseprofiler@mozilla@@SA_NXZ ?IsWin32kLockedDown@mozilla@@YA_NXZ ?MapRemoteViewOfFile@mozilla@@YAPEAXPEAX0_K01KK@Z ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z ?PollPreXULSkeletonUIEvents@mozilla@@YAXXZ ?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?SetGeckoProcessType@mozilla@@YAXPEBD@Z ?SetWin32kLockedDownInPolicy@mozilla@@YAXXZ ?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?WindowsDpiInitialization@mozilla@@YA?AW4WindowsDpiInitializationResult@1@XZ ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AEAAXXZ ?gTwoCharEscapes@detail@mozilla@@3QBDB ?lock@MutexImpl@detail@mozilla@@IEAAXXZ ?profiler_current_thread_id@baseprofiler@mozilla@@YA?AVBaseProfilerThreadId@12@XZ ?profiler_init@baseprofiler@mozilla@@YAXPEAX@Z ?profiler_shutdown@baseprofiler@mozilla@@YAXXZ ?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A ?unlock@MutexImpl@detail@mozilla@@IEAAXXZ ?vprint@PrintfTarget@mozilla@@QEAA_NPEBDPEAD@Z _wcsdup free malloc moz_xmalloc mozalloc_abort realloc strdup

ntdll

NtMapViewOfSection NtOpenFile NtQueryInformationProcess NtQueryObject NtQueryVirtualMemory NtReadVirtualMemory NtUnmapViewOfSection RtlAcquireSRWLockExclusive RtlAcquireSRWLockShared RtlAddFunctionTable RtlAllocateHeap RtlAnsiStringToUnicodeString RtlCaptureContext RtlCaptureStackBackTrace RtlCompareMemory RtlCompareUnicodeString RtlDuplicateUnicodeString RtlEqualUnicodeString RtlFreeHeap RtlFreeUnicodeString RtlGetLastWin32Error RtlGetVersion RtlInitAnsiString RtlInitUnicodeString RtlLookupFunctionEntry RtlNtStatusToDosError RtlQueryPerformanceCounter RtlReAllocateHeap RtlReleaseSRWLockExclusive RtlReleaseSRWLockShared RtlRunOnceExecuteOnce RtlRunOnceInitialize RtlSetLastWin32Error RtlVirtualUnwind VerSetConditionMask memcmp memcpy memmove memset

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject AttachConsole CloseHandle CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DebugBreak DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeEnvironmentStringsW FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW GlobalMemoryStatusEx HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus ProcessIdToSessionId QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ResetEvent ResumeThread SearchPathW SetDllDirectoryW SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadAffinityMask SetUnhandledExceptionFilter SignalObjectAndWait Sleep TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteProcessMemory lstrlenW

vcruntime140

_CxxThrowException __C_specific_handler __current_exception __current_exception_context _purecall strrchr wcschr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vswprintf _dup _fileno _get_osfhandle _set_fmode _wfopen _wtmpnam_s fclose fgets freopen

api-ms-win-crt-environment-l1-1-0

__p__environ _putenv _wgetenv getenv

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _beginthreadex _c_exit _cexit _configure_wide_argv _crt_atexit _errno _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen ceilf

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 strftime

api-ms-win-crt-convert-l1-1-0

_ltoa_s wcstoul

api-ms-win-crt-string-l1-1-0

_stricmp _wcslwr_s _wcsnicmp strcpy strlen towlower wcscat_s wcscmp wcscpy wcscpy_s wcslen wcsncmp wcsncpy wcspbrk wcstok_s

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s _wsplitpath_s

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

GetHandleVerifier GetNtLoaderAPI IsSandboxedProcess NativeNtBlockSet_Write TargetConfigureOPMProtectedOutput TargetConfigureOPMProtectedOutput64 TargetCreateNamedPipeW TargetCreateNamedPipeW64 TargetCreateOPMProtectedOutputs TargetCreateOPMProtectedOutputs64 TargetCreateProcessA TargetCreateProcessA64 TargetCreateProcessW TargetCreateProcessW64 TargetCreateThread TargetCreateThread64 TargetDestroyOPMProtectedOutput TargetDestroyOPMProtectedOutput64 TargetEnumDisplayDevicesA TargetEnumDisplayDevicesA64 TargetEnumDisplayMonitors TargetEnumDisplayMonitors64 TargetGdiDllInitialize TargetGdiDllInitialize64 TargetGetCertificate TargetGetCertificate64 TargetGetCertificateByHandle TargetGetCertificateByHandle64 TargetGetCertificateSize TargetGetCertificateSize64 TargetGetCertificateSizeByHandle TargetGetCertificateSizeByHandle64 TargetGetMonitorInfoA TargetGetMonitorInfoA64 TargetGetMonitorInfoW TargetGetMonitorInfoW64 TargetGetOPMInformation TargetGetOPMInformation64 TargetGetOPMRandomNumber TargetGetOPMRandomNumber64 TargetGetStockObject TargetGetStockObject64 TargetGetSuggestedOPMProtectedOutputArraySize TargetGetSuggestedOPMProtectedOutputArraySize64 TargetNtCreateEvent TargetNtCreateEvent64 TargetNtCreateFile TargetNtCreateFile64 TargetNtCreateKey TargetNtCreateKey64 TargetNtCreateSection TargetNtCreateSection64 TargetNtMapViewOfSection TargetNtMapViewOfSection64 TargetNtOpenEvent TargetNtOpenEvent64 TargetNtOpenFile TargetNtOpenFile64 TargetNtOpenKey TargetNtOpenKey64 TargetNtOpenKeyEx TargetNtOpenKeyEx64 TargetNtOpenProcess TargetNtOpenProcess64 TargetNtOpenProcessToken TargetNtOpenProcessToken64 TargetNtOpenProcessTokenEx TargetNtOpenProcessTokenEx64 TargetNtOpenThread TargetNtOpenThread64 TargetNtOpenThreadToken TargetNtOpenThreadToken64 TargetNtOpenThreadTokenEx TargetNtOpenThreadTokenEx64 TargetNtQueryAttributesFile TargetNtQueryAttributesFile64 TargetNtQueryFullAttributesFile TargetNtQueryFullAttributesFile64 TargetNtSetInformationFile TargetNtSetInformationFile64 TargetNtSetInformationThread TargetNtSetInformationThread64 TargetNtUnmapViewOfSection TargetNtUnmapViewOfSection64 TargetRegisterClassW TargetRegisterClassW64 TargetSetOPMSigningKeyAndSequenceNumbers TargetSetOPMSigningKeyAndSequenceNumbers64 g_handles_to_close g_interceptions g_nt g_originals g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section

Name

.text

Size

335KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.freestd

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

36B

Characteristics

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

27B

Characteristics

Name

.rsrc

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_f6a687d03b69b71b4d5dacdd6114bae2_cobalt-strike_mespinoza

mozglue

ntdll

msvcp140

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic