2026-07-30_828afd7d4a662e524b6b99bdc2d242fb_cobalt-strike_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_828afd7d4a662e524b6b99bdc2d242fb_cobalt-strike_mespinoza
Size 297KB
Sample260730-vyv7wadn8w
SHA256 049ff41eae998c83ffc4a1d0a02b22a300cfe5838d8bc02d855165e6f737768e
MD5 828afd7d4a662e524b6b99bdc2d242fb
SHA1 93d778b0e250d122d2220937769a510294ecfd11
SHA512 5e134a48ebab5ce924a6bdaff3f940432b4ca2596cec8919644b54f8d84774b038de905f7f3a30c29edb8b50028d51fb3c96cc9b6d421d7bf129667feb2113ea
SSDEEP 6144:tRsuwkL1G+l2BYq9In4k/8As91Iwn9ATuZ/NZZz3nsU:3wNQfs9KloFX4U
TLSH
T1B8547C43661960BAD89BC0B9A6839421FA717C4D0730B4DF52D4BF366E687E06F38F85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_828afd7d4a662e524b6b99bdc2d242fb_cobalt-strike_mespinoza

File Explorer

2026-07-30_828afd7d4a662e524b6b99bdc2d242fb_cobalt-strike_mespinoza

.exe 297KB

2026-07-30_828afd7d4a662e524b6b99bdc2d242fb_cobalt-strike_mespinoza

IMPHASH 2b7ef9fc3cfb0fc4f967c7722dc9f941
SHA256 049ff41eae998c83ffc4a1d0a02b22a300cfe5838d8bc02d855165e6f737768e
MD5 828afd7d4a662e524b6b99bdc2d242fb
SHA1 93d778b0e250d122d2220937769a510294ecfd11
SHA512 5e134a48ebab5ce924a6bdaff3f940432b4ca2596cec8919644b54f8d84774b038de905f7f3a30c29edb8b50028d51fb3c96cc9b6d421d7bf129667feb2113ea
SSDEEP 6144:tRsuwkL1G+l2BYq9In4k/8As91Iwn9ATuZ/NZZz3nsU:3wNQfs9KloFX4U
TLSH
T1B8547C43661960BAD89BC0B9A6839421FA717C4D0730B4DF52D4BF366E687E06F38F85
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

160128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\task_1579288126\build\src\obj-firefox\toolkit\crashreporter\client\crashreporter.pdb

nss3

HASH_Begin HASH_Create HASH_Destroy HASH_End HASH_Update NSS_Initialize

user32

BeginPaint CallWindowProcW CheckDlgButton ChildWindowFromPoint CloseClipboard DialogBoxIndirectParamW DialogBoxParamW DrawTextW EnableWindow EndDialog EndPaint FillRect GetClientRect GetClipboardData GetDC GetDlgItem GetDlgItemTextW GetFocus GetPropW GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW InvalidateRect IsClipboardFormatAvailable IsDlgButtonChecked IsWindowEnabled LoadIconW MapWindowPoints MessageBoxW MoveWindow OpenClipboard PostMessageW RemovePropW SendDlgItemMessageW SendMessageW SetDlgItemTextW SetFocus SetPropW SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow

gdi32

GetStockObject GetTextExtentPoint32W SelectObject SetBkMode SetTextColor

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControlsEx

ole32

CoCreateGuid

shell32

SHGetFolderPathW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetOpenW InternetQueryDataAvailable InternetReadFile InternetSetOptionW

shlwapi

PathAppendW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??Bid@locale@std@@QEAA_KXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?bad@ios_base@std@@QEBA_NXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

CloseHandle CompareFileTime CreateDirectoryW CreateEventW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTime GetSystemTimeAsFileTime GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MoveFileW MultiByteToWideChar QueryPerformanceCounter ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEvent SetUnhandledExceptionFilter SizeofResource TerminateProcess UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __std_exception_copy __std_exception_destroy __std_terminate memchr memcmp memcpy memmove memset wcsrchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vswprintf_s _fseeki64 _get_stream_buffer_pointers _set_fmode _wfopen_s fclose fflush fgetc fgetpos fgets fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_wide_winmain_command_line _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _dtest ceilf modf

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64 _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_putenv _wgetenv getenv

api-ms-win-crt-string-l1-1-0

_strdup strcat strcmp strcpy strlen wcscmp wcscpy wcslen wcsncpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_828afd7d4a662e524b6b99bdc2d242fb_cobalt-strike_mespinoza

nss3

user32

gdi32

advapi32

comctl32

ole32

shell32

wininet

shlwapi

msvcp140

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic