2026-08-01_dd27a6ab8ba433c14ab2676c07e8ad7a_cobalt-strike_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_dd27a6ab8ba433c14ab2676c07e8ad7a_cobalt-strike_mespinoza
Size 297KB
Sample260801-xvszfseq6z
SHA256 2e3457b58ba3d55eeeec34c1a44c35c387bb24c3dc088d05a25bf58e362a1bf5
MD5 dd27a6ab8ba433c14ab2676c07e8ad7a
SHA1 57d795de9114b3f387fa24a2087537c2393dfe92
SHA512 436377d13a6e442a9f3d2cc9de1db7a888e924e9275e4e316b06a1f01f5c448e702279214c534cbf03d7d3c00b5de6ca28b6158da241261adc3a7c5d9ed93490
SSDEEP 6144:w2sPgMu2Z/Irskll+zNLX782s9jIwn9ATuZGSA2/2vGfzP:Cg1otFs9Elos2XfT
TLSH
T162548D43622960FAD98BC0B9A6835521FA717C490734B4DF12C47B366E68BE06F3DF85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_dd27a6ab8ba433c14ab2676c07e8ad7a_cobalt-strike_mespinoza

File Explorer

2026-08-01_dd27a6ab8ba433c14ab2676c07e8ad7a_cobalt-strike_mespinoza

.exe 297KB

2026-08-01_dd27a6ab8ba433c14ab2676c07e8ad7a_cobalt-strike_mespinoza

IMPHASH 2b7ef9fc3cfb0fc4f967c7722dc9f941
SHA256 2e3457b58ba3d55eeeec34c1a44c35c387bb24c3dc088d05a25bf58e362a1bf5
MD5 dd27a6ab8ba433c14ab2676c07e8ad7a
SHA1 57d795de9114b3f387fa24a2087537c2393dfe92
SHA512 436377d13a6e442a9f3d2cc9de1db7a888e924e9275e4e316b06a1f01f5c448e702279214c534cbf03d7d3c00b5de6ca28b6158da241261adc3a7c5d9ed93490
SSDEEP 6144:w2sPgMu2Z/Irskll+zNLX782s9jIwn9ATuZGSA2/2vGfzP:Cg1otFs9Elos2XfT
TLSH
T162548D43622960FAD98BC0B9A6835521FA717C490734B4DF12C47B366E68BE06F3DF85
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

160128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\task_1579288126\build\src\obj-firefox\toolkit\crashreporter\client\crashreporter.pdb

nss3

HASH_Begin HASH_Create HASH_Destroy HASH_End HASH_Update NSS_Initialize

user32

BeginPaint CallWindowProcW CheckDlgButton ChildWindowFromPoint CloseClipboard DialogBoxIndirectParamW DialogBoxParamW DrawTextW EnableWindow EndDialog EndPaint FillRect GetClientRect GetClipboardData GetDC GetDlgItem GetDlgItemTextW GetFocus GetPropW GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW InvalidateRect IsClipboardFormatAvailable IsDlgButtonChecked IsWindowEnabled LoadIconW MapWindowPoints MessageBoxW MoveWindow OpenClipboard PostMessageW RemovePropW SendDlgItemMessageW SendMessageW SetDlgItemTextW SetFocus SetPropW SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow

gdi32

GetStockObject GetTextExtentPoint32W SelectObject SetBkMode SetTextColor

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControlsEx

ole32

CoCreateGuid

shell32

SHGetFolderPathW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetOpenW InternetQueryDataAvailable InternetReadFile InternetSetOptionW

shlwapi

PathAppendW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??Bid@locale@std@@QEAA_KXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?bad@ios_base@std@@QEBA_NXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

CloseHandle CompareFileTime CreateDirectoryW CreateEventW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTime GetSystemTimeAsFileTime GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MoveFileW MultiByteToWideChar QueryPerformanceCounter ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEvent SetUnhandledExceptionFilter SizeofResource TerminateProcess UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __std_exception_copy __std_exception_destroy __std_terminate memchr memcmp memcpy memmove memset wcsrchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vswprintf_s _fseeki64 _get_stream_buffer_pointers _set_fmode _wfopen_s fclose fflush fgetc fgetpos fgets fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_wide_winmain_command_line _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _dtest ceilf modf

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64 _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_putenv _wgetenv getenv

api-ms-win-crt-string-l1-1-0

_strdup strcat strcmp strcpy strlen wcscmp wcscpy wcslen wcsncpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_dd27a6ab8ba433c14ab2676c07e8ad7a_cobalt-strike_mespinoza

nss3

user32

gdi32

advapi32

comctl32

ole32

shell32

wininet

shlwapi

msvcp140

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic