2026-07-19_0ab1ab40cc8ec5af4b5a3e92a10d563d_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_0ab1ab40cc8ec5af4b5a3e92a10d563d_cobalt-strike_mespinoza_satacom
Size 243KB
Sample260720-cbpgpsew7z
SHA256 797731c40ab99d8968da80e64e58d2431fa58d720fbbeff1a752752251c67562
MD5 0ab1ab40cc8ec5af4b5a3e92a10d563d
SHA1 0009efa1cfdb3bf5927a56cb2f268a4671374950
SHA512 1a4e3f6bd935ddc5b22e6974fd464d32d62e806d8cbf641bf90daabd9f51dd92e3c656353068bfc7191e17d26e85953fdef701f55fff55cc773975cfaa7f02be
SSDEEP 6144:G6Yrb+xsqp/Gl7bC5sVo488jlcjY+5NObiXuu7:G62b+E88jK8SX
TLSH
T101343D137A055CBEDEC6C4B9B28B58565B2478CB0B71E8CB17D09A3A2F9B6F04F39510
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_0ab1ab40cc8ec5af4b5a3e92a10d563d_cobalt-strike_mespinoza_satacom

File Explorer

2026-07-19_0ab1ab40cc8ec5af4b5a3e92a10d563d_cobalt-strike_mespinoza_satacom

.exe 243KB

2026-07-19_0ab1ab40cc8ec5af4b5a3e92a10d563d_cobalt-strike_mespinoza_satacom

IMPHASH cd5cefa8c693ecf38b5dd11b84737f76
SHA256 797731c40ab99d8968da80e64e58d2431fa58d720fbbeff1a752752251c67562
MD5 0ab1ab40cc8ec5af4b5a3e92a10d563d
SHA1 0009efa1cfdb3bf5927a56cb2f268a4671374950
SHA512 1a4e3f6bd935ddc5b22e6974fd464d32d62e806d8cbf641bf90daabd9f51dd92e3c656353068bfc7191e17d26e85953fdef701f55fff55cc773975cfaa7f02be
SSDEEP 6144:G6Yrb+xsqp/Gl7bC5sVo488jlcjY+5NObiXuu7:G62b+E88jK8SX
TLSH
T101343D137A055CBEDEC6C4B9B28B58565B2478CB0B71E8CB17D09A3A2F9B6F04F39510
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

llama-common

??1common_init_result@@QEAA@XZ ?common_batch_add@@YAXAEAUllama_batch@@HHAEBV?$vector@HV?$allocator@H@std@@@std@@_N@Z ?common_batch_clear@@YAXAEAUllama_batch@@@Z ?common_imatrix_load@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAUcommon_imatrix@@@Z ?common_init@@YAXXZ ?common_init_from_params@@YA?AV?$unique_ptr@Ucommon_init_result@@U?$default_delete@Ucommon_init_result@@@std@@@std@@AEAUcommon_params@@_N@Z ?common_log_add@@YAXPEAUcommon_log@@W4ggml_log_level@@PEBDZZ ?common_log_get_verbosity_thold@@YAHXZ ?common_log_main@@YAPEAUcommon_log@@XZ ?common_params_get_system_info@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUcommon_params@@@Z ?common_params_parse@@YA_NHPEAPEADAEAUcommon_params@@W4llama_example@@P6AXH0@Z@Z ?common_tokenize@@YA?AV?$vector@HV?$allocator@H@std@@@std@@PEBUllama_context@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@_N2@Z ?context@common_init_result@@QEAAPEAUllama_context@@XZ ?model@common_init_result@@QEAAPEAUllama_model@@XZ

llama

llama_backend_free llama_backend_init llama_batch_free llama_batch_init llama_decode llama_get_logits llama_get_logits_ith llama_get_memory llama_get_model llama_max_devices llama_memory_clear llama_model_get_vocab llama_model_n_ctx_train llama_numa_init llama_perf_context_print llama_pooling_type llama_synchronize llama_vocab_bos llama_vocab_get_add_bos llama_vocab_get_add_eos llama_vocab_n_tokens

ggml-base

ggml_abort ggml_backend_buffer_is_host ggml_backend_tensor_get ggml_element_size ggml_format_name ggml_free ggml_init ggml_nbytes ggml_new_tensor_2d ggml_nrows ggml_op_name ggml_tensor_overhead gguf_add_tensor gguf_free gguf_init_empty gguf_set_arr_str gguf_set_val_str gguf_set_val_u32 gguf_write_to_file

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??0facet@locale@std@@IEAA@_K@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1facet@locale@std@@MEAA@XZ ??1ios_base@std@@UEAA@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fail@ios_base@std@@QEBA_NXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Cnd_do_broadcast_at_thread_exit _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Strcoll _Strxfrm _Thrd_hardware_concurrency _Thrd_id _Thrd_join __crtLCMapStringA

kernel32

AcquireSRWLockExclusive GetCurrentProcessId GetCurrentThreadId GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead QueryPerformanceCounter ReleaseSRWLockExclusive SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __RTtypeid __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare memchr memcmp memcpy memmove memset strchr

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func ___lc_locale_name_func _configthreadlocale setlocale

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode _fseeki64 _get_stream_buffer_pointers _set_fmode fclose fflush fgetc fgetpos fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _errno _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf exp expf log log2 log2f sqrt sqrtf

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc realloc

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-string-l1-1-0

strlen

Name

.text

Size

182KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

388B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_0ab1ab40cc8ec5af4b5a3e92a10d563d_cobalt-strike_mespinoza_satacom

llama-common

llama

ggml-base

msvcp140

kernel32

vcruntime140

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

generic