2026-08-03_0b1cc9c4ca655396d76d9909e252b427_cobalt-strike_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_0b1cc9c4ca655396d76d9909e252b427_cobalt-strike_mespinoza
Size 297KB
Sample260804-d2216a1dqc
SHA256 33a5750a59569cfb7a43cc3736eb8bab5228fe7e92f3d0ec4c0ff61e110b1d3f
MD5 0b1cc9c4ca655396d76d9909e252b427
SHA1 5d0e2957545a210f08b1b658da5d368a6bd2e6d1
SHA512 82089dbfe8d1465f0a6b80089e77a0a429361015f5dbffa23dcb0821ff47c6d64d9309e3e57115546a734dcf78fbb1efc6fe450dca27b450b1d9d5dfc7df7516
SSDEEP 6144:xys6WK6DFMATezIkAt48td887s9NIwn9ATuZjj2rg3+:AW/1+Qs9ilojA
TLSH
T15F547B43A62960F9D58BC0B8A6935525F9B17C4A0734B4CF02C47F366E68BE06F39F85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_0b1cc9c4ca655396d76d9909e252b427_cobalt-strike_mespinoza

File Explorer

2026-08-03_0b1cc9c4ca655396d76d9909e252b427_cobalt-strike_mespinoza

.exe 297KB

2026-08-03_0b1cc9c4ca655396d76d9909e252b427_cobalt-strike_mespinoza

IMPHASH 2b7ef9fc3cfb0fc4f967c7722dc9f941
SHA256 33a5750a59569cfb7a43cc3736eb8bab5228fe7e92f3d0ec4c0ff61e110b1d3f
MD5 0b1cc9c4ca655396d76d9909e252b427
SHA1 5d0e2957545a210f08b1b658da5d368a6bd2e6d1
SHA512 82089dbfe8d1465f0a6b80089e77a0a429361015f5dbffa23dcb0821ff47c6d64d9309e3e57115546a734dcf78fbb1efc6fe450dca27b450b1d9d5dfc7df7516
SSDEEP 6144:xys6WK6DFMATezIkAt48td887s9NIwn9ATuZjj2rg3+:AW/1+Qs9ilojA
TLSH
T15F547B43A62960F9D58BC0B8A6935525F9B17C4A0734B4CF02C47F366E68BE06F39F85
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

160128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\task_1579288126\build\src\obj-firefox\toolkit\crashreporter\client\crashreporter.pdb

nss3

HASH_Begin HASH_Create HASH_Destroy HASH_End HASH_Update NSS_Initialize

user32

BeginPaint CallWindowProcW CheckDlgButton ChildWindowFromPoint CloseClipboard DialogBoxIndirectParamW DialogBoxParamW DrawTextW EnableWindow EndDialog EndPaint FillRect GetClientRect GetClipboardData GetDC GetDlgItem GetDlgItemTextW GetFocus GetPropW GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW InvalidateRect IsClipboardFormatAvailable IsDlgButtonChecked IsWindowEnabled LoadIconW MapWindowPoints MessageBoxW MoveWindow OpenClipboard PostMessageW RemovePropW SendDlgItemMessageW SendMessageW SetDlgItemTextW SetFocus SetPropW SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow

gdi32

GetStockObject GetTextExtentPoint32W SelectObject SetBkMode SetTextColor

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControlsEx

ole32

CoCreateGuid

shell32

SHGetFolderPathW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetOpenW InternetQueryDataAvailable InternetReadFile InternetSetOptionW

shlwapi

PathAppendW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??Bid@locale@std@@QEAA_KXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?bad@ios_base@std@@QEBA_NXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

CloseHandle CompareFileTime CreateDirectoryW CreateEventW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTime GetSystemTimeAsFileTime GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MoveFileW MultiByteToWideChar QueryPerformanceCounter ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEvent SetUnhandledExceptionFilter SizeofResource TerminateProcess UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __std_exception_copy __std_exception_destroy __std_terminate memchr memcmp memcpy memmove memset wcsrchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vswprintf_s _fseeki64 _get_stream_buffer_pointers _set_fmode _wfopen_s fclose fflush fgetc fgetpos fgets fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_wide_winmain_command_line _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _dtest ceilf modf

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64 _time64 strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_putenv _wgetenv getenv

api-ms-win-crt-string-l1-1-0

_strdup strcat strcmp strcpy strlen wcscmp wcscpy wcslen wcsncpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_0b1cc9c4ca655396d76d9909e252b427_cobalt-strike_mespinoza

nss3

user32

gdi32

advapi32

comctl32

ole32

shell32

wininet

shlwapi

msvcp140

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic