2026-07-23_8c066f53181143616abc3b687a9b03ab_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_8c066f53181143616abc3b687a9b03ab_cobalt-strike_mespinoza_satacom
Size 1.4MB
Sample260723-fd4aesgd33
SHA256 9e84a15f5f976cedea3afb3b54b656715b2a65d70d858c2cdcae912bc61c7e0b
MD5 8c066f53181143616abc3b687a9b03ab
SHA1 02e6bfbadb9e699fce9a34bac11d00898d592fc5
SHA512 e8f0ecf08828897ae626e5a499d7f25f356a5f5a5f8b22e7e609c5b92861fdda2ee21fc95aa6ada0e232af15e1a3b0e3631b204b6f01edca14bf7d965d24542a
SSDEEP 24576:iXEro3c2la/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iXdc2oLNiXicJFFRGNzj3
TLSH
T1F6650113F94950F6D5ACC438CB524512EBA27C8A473166DF63942DA52FB8FE8AF3C241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_8c066f53181143616abc3b687a9b03ab_cobalt-strike_mespinoza_satacom

File Explorer

2026-07-23_8c066f53181143616abc3b687a9b03ab_cobalt-strike_mespinoza_satacom

.exe 1.4MB

2026-07-23_8c066f53181143616abc3b687a9b03ab_cobalt-strike_mespinoza_satacom

IMPHASH 67659f21d26cd0e7a890e5341ec017cd
SHA256 9e84a15f5f976cedea3afb3b54b656715b2a65d70d858c2cdcae912bc61c7e0b
MD5 8c066f53181143616abc3b687a9b03ab
SHA1 02e6bfbadb9e699fce9a34bac11d00898d592fc5
SHA512 e8f0ecf08828897ae626e5a499d7f25f356a5f5a5f8b22e7e609c5b92861fdda2ee21fc95aa6ada0e232af15e1a3b0e3631b204b6f01edca14bf7d965d24542a
SSDEEP 24576:iXEro3c2la/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iXdc2oLNiXicJFFRGNzj3
TLSH
T1F6650113F94950F6D5ACC438CB524512EBA27C8A473166DF63942DA52FB8FE8AF3C241
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

plugin-container.pdb

mozglue

??2@YAPEAX_K@Z ??3@YAXPEAX@Z ??3@YAXPEAX_K@Z ??_U@YAPEAX_K@Z ??_V@YAXPEAX@Z ?DllBlocklist_Initialize@@YAXI@Z ?InvalidArrayIndex_CRASH@detail@mozilla@@YAX_K0@Z ?IsWin32kLockedDown@mozilla@@YA_NXZ ?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?SetGeckoChildID@mozilla@@YAXPEBD@Z ?SetGeckoProcessType@mozilla@@YAXPEBD@Z ?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A free malloc moz_xmalloc mozalloc_abort realloc

advapi32

AddMandatoryAce GetAce GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo InitializeAcl IsValidAcl IsValidSecurityDescriptor IsValidSid OpenProcessToken RegCloseKey RegDisablePredefinedCache RegOpenKeyExW RevertToSelf SetKernelObjectSecurity SetSecurityInfo SetTokenInformation

ntdll

NtQueryVirtualMemory RtlAddFunctionTable RtlLookupFunctionEntry RtlNtStatusToDosError RtlSetLastWin32Error

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetLastError GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetProductInfo GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSectionEx InitializeSListHead IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryW LocalFree QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive SetDefaultDllDirectories SetDllDirectoryW SetEnvironmentVariableW SetHandleInformation SetLastError SetProcessMitigationPolicy SetThreadAffinityMask SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsGetValue TlsSetValue TryAcquireSRWLockExclusive VirtualAlloc VirtualFree VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte

vcruntime140

__C_specific_handler __current_exception __current_exception_context memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _errno _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-string-l1-1-0

_wcsnicmp strlen wcscmp wcslen wcsncmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf ldexp

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

GetHandleVerifier IsSandboxedProcess TargetCreateNamedPipeW TargetCreateNamedPipeW64 TargetCreateThread TargetCreateThread64 TargetGdiDllInitialize TargetGdiDllInitialize64 TargetGetForegroundWindow TargetGetForegroundWindow64 TargetGetStockObject TargetGetStockObject64 TargetNtCreateFile TargetNtCreateFile64 TargetNtCreateKey TargetNtCreateKey64 TargetNtCreateSection TargetNtCreateSection64 TargetNtImpersonateAnonymousToken TargetNtImpersonateAnonymousToken64 TargetNtMapViewOfSection TargetNtMapViewOfSection64 TargetNtOpenFile TargetNtOpenFile64 TargetNtOpenKey TargetNtOpenKey64 TargetNtOpenKeyEx TargetNtOpenKeyEx64 TargetNtOpenProcess TargetNtOpenProcess64 TargetNtOpenProcessToken TargetNtOpenProcessToken64 TargetNtOpenProcessTokenEx TargetNtOpenProcessTokenEx64 TargetNtOpenSection TargetNtOpenSection64 TargetNtOpenThread TargetNtOpenThread64 TargetNtOpenThreadToken TargetNtOpenThreadToken64 TargetNtOpenThreadTokenEx TargetNtOpenThreadTokenEx64 TargetNtQueryAttributesFile TargetNtQueryAttributesFile64 TargetNtQueryFullAttributesFile TargetNtQueryFullAttributesFile64 TargetNtSetInformationFile TargetNtSetInformationFile64 TargetNtSetInformationThread TargetNtSetInformationThread64 TargetNtUnmapViewOfSection TargetNtUnmapViewOfSection64 TargetRegisterClassW TargetRegisterClassW64 g_current_mitigations g_delegate_data_size g_handles_to_close g_interceptions g_nt g_originals g_sentinel_value_end g_sentinel_value_start g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section g_shared_startup_mitigations

Name

.text

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_8c066f53181143616abc3b687a9b03ab_cobalt-strike_mespinoza_satacom

mozglue

advapi32

ntdll

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic