2026-07-22_be6812fb384e038d01810cc4c2706ea6_cobalt-strike_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_be6812fb384e038d01810cc4c2706ea6_cobalt-strike_mespinoza
Size 297KB
Sample260722-zpc26azzct
SHA256 6697c6cf93db5077eaa443d9b2d19b4d5edb31398eb62adc1e26252cca6fe3cb
MD5 be6812fb384e038d01810cc4c2706ea6
SHA1 de9ed6f4be29bbffd7f5183d331f8a006f2d4802
SHA512 66a37eaab1f688a115a2f283e0816a8bb75e1e3d42eb0d6a7fe5a2e03f38b81240f9a8caead8251a0dcdef3dbf469e01bcdd324e056b4911b0791587654dc75d
SSDEEP 6144:WWsP36CDohUV+cyPYAwPUg8Es9VIwn9ATuZwIA5Fyz:Y302Ds9qloiqz
TLSH
T16D547B43A21960FAD48BC0B9A6839565FA717C490730B4DF12C47B376E69BE06F39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_be6812fb384e038d01810cc4c2706ea6_cobalt-strike_mespinoza

File Explorer

2026-07-22_be6812fb384e038d01810cc4c2706ea6_cobalt-strike_mespinoza

.exe 297KB

2026-07-22_be6812fb384e038d01810cc4c2706ea6_cobalt-strike_mespinoza

IMPHASH 2b7ef9fc3cfb0fc4f967c7722dc9f941
SHA256 6697c6cf93db5077eaa443d9b2d19b4d5edb31398eb62adc1e26252cca6fe3cb
MD5 be6812fb384e038d01810cc4c2706ea6
SHA1 de9ed6f4be29bbffd7f5183d331f8a006f2d4802
SHA512 66a37eaab1f688a115a2f283e0816a8bb75e1e3d42eb0d6a7fe5a2e03f38b81240f9a8caead8251a0dcdef3dbf469e01bcdd324e056b4911b0791587654dc75d
SSDEEP 6144:WWsP36CDohUV+cyPYAwPUg8Es9VIwn9ATuZwIA5Fyz:Y302Ds9qloiqz
TLSH
T16D547B43A21960FAD48BC0B9A6839565FA717C490730B4DF12C47B376E69BE06F39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

160128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\task_1579288126\build\src\obj-firefox\toolkit\crashreporter\client\crashreporter.pdb

nss3

HASH_Begin HASH_Create HASH_Destroy HASH_End HASH_Update NSS_Initialize

user32

BeginPaint CallWindowProcW CheckDlgButton ChildWindowFromPoint CloseClipboard DialogBoxIndirectParamW DialogBoxParamW DrawTextW EnableWindow EndDialog EndPaint FillRect GetClientRect GetClipboardData GetDC GetDlgItem GetDlgItemTextW GetFocus GetPropW GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW InvalidateRect IsClipboardFormatAvailable IsDlgButtonChecked IsWindowEnabled LoadIconW MapWindowPoints MessageBoxW MoveWindow OpenClipboard PostMessageW RemovePropW SendDlgItemMessageW SendMessageW SetDlgItemTextW SetFocus SetPropW SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow

gdi32

GetStockObject GetTextExtentPoint32W SelectObject SetBkMode SetTextColor

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControlsEx

ole32

CoCreateGuid

shell32

SHGetFolderPathW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetOpenW InternetQueryDataAvailable InternetReadFile InternetSetOptionW

shlwapi

PathAppendW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??Bid@locale@std@@QEAA_KXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?bad@ios_base@std@@QEBA_NXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

CloseHandle CompareFileTime CreateDirectoryW CreateEventW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTime GetSystemTimeAsFileTime GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MoveFileW MultiByteToWideChar QueryPerformanceCounter ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEvent SetUnhandledExceptionFilter SizeofResource TerminateProcess UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __std_exception_copy __std_exception_destroy __std_terminate memchr memcmp memcpy memmove memset wcsrchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vswprintf_s _fseeki64 _get_stream_buffer_pointers _set_fmode _wfopen_s fclose fflush fgetc fgetpos fgets fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_wide_winmain_command_line _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _dtest ceilf modf

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64 _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_putenv _wgetenv getenv

api-ms-win-crt-string-l1-1-0

_strdup strcat strcmp strcpy strlen wcscmp wcscpy wcslen wcsncpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_be6812fb384e038d01810cc4c2706ea6_cobalt-strike_mespinoza

nss3

user32

gdi32

advapi32

comctl32

ole32

shell32

wininet

shlwapi

msvcp140

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic