2026-08-10_85ac8f40f612e7f94875a5d3dc45853e_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_85ac8f40f612e7f94875a5d3dc45853e_cobalt-strike_mespinoza_satacom
Size 1.4MB
Sample260810-3rewba1fkh
SHA256 33644690fb5625f5703d3e8126aae322c100cca92a1fd16a3f59a857bcca9a25
MD5 85ac8f40f612e7f94875a5d3dc45853e
SHA1 c4967a22946784eebd52509886cf7daf05364331
SHA512 fb63d10d700fb3bb7c93117251585d7ce4abed38d23e193c0f9468704cd783e3a1fe3309a91968b77420a7c0f8d559311c84ee938c575e962ad0d5a74e512316
SSDEEP 12288:MFA1mI6YDqs3Qq7RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:sa6gqs3Qq1zQPI9hAH8CzQgAqvuG
TLSH
T185650217F95911F6C94DCA759A838A129E72BC911B60B7EF23210CA11FB9AD4BF3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_85ac8f40f612e7f94875a5d3dc45853e_cobalt-strike_mespinoza_satacom

File Explorer

2026-08-10_85ac8f40f612e7f94875a5d3dc45853e_cobalt-strike_mespinoza_satacom

.exe 1.4MB

2026-08-10_85ac8f40f612e7f94875a5d3dc45853e_cobalt-strike_mespinoza_satacom

IMPHASH f9093ce228bb18a12c921e85b0e0a623
SHA256 33644690fb5625f5703d3e8126aae322c100cca92a1fd16a3f59a857bcca9a25
MD5 85ac8f40f612e7f94875a5d3dc45853e
SHA1 c4967a22946784eebd52509886cf7daf05364331
SHA512 fb63d10d700fb3bb7c93117251585d7ce4abed38d23e193c0f9468704cd783e3a1fe3309a91968b77420a7c0f8d559311c84ee938c575e962ad0d5a74e512316
SSDEEP 12288:MFA1mI6YDqs3Qq7RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:sa6gqs3Qq1zQPI9hAH8CzQgAqvuG
TLSH
T185650217F95911F6C94DCA759A838A129E72BC911B60B7EF23210CA11FB9AD4BF3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

plugin-container.pdb

mozglue

??2@YAPEAX_K@Z ??3@YAXPEAX@Z ??3@YAXPEAX_K@Z ??_U@YAPEAX_K@Z ??_V@YAXPEAX@Z ?DllBlocklist_Initialize@@YAXI@Z ?InvalidArrayIndex_CRASH@detail@mozilla@@YAX_K0@Z ?IsWin32kLockedDown@mozilla@@YA_NXZ ?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?SetGeckoChildID@mozilla@@YAXPEBD@Z ?SetGeckoProcessType@mozilla@@YAXPEBD@Z ?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A calloc free malloc moz_xmalloc mozalloc_abort realloc

advapi32

AddMandatoryAce GetAce GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo InitializeAcl IsValidAcl IsValidSecurityDescriptor IsValidSid OpenProcessToken RegCloseKey RegDisablePredefinedCache RegOpenKeyExW RevertToSelf SetKernelObjectSecurity SetSecurityInfo SetTokenInformation

ntdll

NtQueryVirtualMemory RtlAddFunctionTable RtlLookupFunctionEntry RtlNtStatusToDosError RtlSetLastWin32Error

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetLastError GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetProductInfo GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSectionEx InitializeSListHead IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryW LocalFree QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive SetDefaultDllDirectories SetDllDirectoryW SetEnvironmentVariableW SetHandleInformation SetLastError SetProcessMitigationPolicy SetThreadAffinityMask SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsGetValue TlsSetValue TryAcquireSRWLockExclusive VirtualAlloc VirtualFree VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte

vcruntime140

__C_specific_handler __current_exception __current_exception_context memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _errno _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-string-l1-1-0

_wcsnicmp strlen wcscmp wcslen wcsncmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf ldexp

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

GetHandleVerifier IsSandboxedProcess TargetCreateNamedPipeW TargetCreateNamedPipeW64 TargetCreateThread TargetCreateThread64 TargetGdiDllInitialize TargetGdiDllInitialize64 TargetGetForegroundWindow TargetGetForegroundWindow64 TargetGetStockObject TargetGetStockObject64 TargetNtCreateFile TargetNtCreateFile64 TargetNtCreateKey TargetNtCreateKey64 TargetNtCreateSection TargetNtCreateSection64 TargetNtImpersonateAnonymousToken TargetNtImpersonateAnonymousToken64 TargetNtMapViewOfSection TargetNtMapViewOfSection64 TargetNtOpenFile TargetNtOpenFile64 TargetNtOpenKey TargetNtOpenKey64 TargetNtOpenKeyEx TargetNtOpenKeyEx64 TargetNtOpenProcess TargetNtOpenProcess64 TargetNtOpenProcessToken TargetNtOpenProcessToken64 TargetNtOpenProcessTokenEx TargetNtOpenProcessTokenEx64 TargetNtOpenSection TargetNtOpenSection64 TargetNtOpenThread TargetNtOpenThread64 TargetNtOpenThreadToken TargetNtOpenThreadToken64 TargetNtOpenThreadTokenEx TargetNtOpenThreadTokenEx64 TargetNtQueryAttributesFile TargetNtQueryAttributesFile64 TargetNtQueryFullAttributesFile TargetNtQueryFullAttributesFile64 TargetNtSetInformationFile TargetNtSetInformationFile64 TargetNtSetInformationThread TargetNtSetInformationThread64 TargetNtUnmapViewOfSection TargetNtUnmapViewOfSection64 TargetRegisterClassW TargetRegisterClassW64 g_current_mitigations g_delegate_data_size g_handles_to_close g_interceptions g_nt g_originals g_sentinel_value_end g_sentinel_value_start g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section g_shared_startup_mitigations

Name

.text

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_85ac8f40f612e7f94875a5d3dc45853e_cobalt-strike_mespinoza_satacom

mozglue

advapi32

ntdll

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic