2026-09-19_138a7e15dda7e7c038d46f437a7bfa0e_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_138a7e15dda7e7c038d46f437a7bfa0e_cobalt-strike_mespinoza_satacom
Size 64KB
Sample260919-rfkrmswt9k
SHA256 8b95fad02907080bde6482e812bf3d040d310859e49e3bd62bb9f778d6dcaf57
MD5 138a7e15dda7e7c038d46f437a7bfa0e
SHA1 b6ac8cb4785dc65ae3446b8f7aa5de007d15be68
SHA512 6e5ead759dc9b40e37aa55166d1527e68f0ac46e3860898cb6c3013cb638c79afb908c9b7f04c460edb41d73607a2f39eccab255a77b95f7564070f6db0f6052
SSDEEP 1536:6VZCTQ41jqf3f7+ewpfclieQ5BuvA2+N:Ml/DbwWBQ5BuY2+
TLSH
T10253491B774580F8C446C0B9868346569A72FA890F31B6CF47D6932E3E707F4AF39A64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_138a7e15dda7e7c038d46f437a7bfa0e_cobalt-strike_mespinoza_satacom

File Explorer

2026-09-19_138a7e15dda7e7c038d46f437a7bfa0e_cobalt-strike_mespinoza_satacom

.exe 64KB

2026-09-19_138a7e15dda7e7c038d46f437a7bfa0e_cobalt-strike_mespinoza_satacom

IMPHASH 7bd3239a67d4b76c082ca202e36b04e5
SHA256 8b95fad02907080bde6482e812bf3d040d310859e49e3bd62bb9f778d6dcaf57
MD5 138a7e15dda7e7c038d46f437a7bfa0e
SHA1 b6ac8cb4785dc65ae3446b8f7aa5de007d15be68
SHA512 6e5ead759dc9b40e37aa55166d1527e68f0ac46e3860898cb6c3013cb638c79afb908c9b7f04c460edb41d73607a2f39eccab255a77b95f7564070f6db0f6052
SSDEEP 1536:6VZCTQ41jqf3f7+ewpfclieQ5BuvA2+N:Ml/DbwWBQ5BuY2+
TLSH
T10253491B774580F8C446C0B9868346569A72FA890F31B6CF47D6932E3E707F4AF39A64
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CreateFile2 CreateToolhelp32Snapshot FindClose FindFirstFileW FormatMessageA GetConsoleMode GetConsoleScreenBufferInfo GetCurrentProcessId GetCurrentThreadId GetFileAttributesExW GetFileInformationByHandleEx GetLastError GetLocaleInfoEx GetModuleHandleW GetStdHandle GetSystemTimeAsFileTime InitializeSListHead LocalFree Module32FirstW Module32NextW MultiByteToWideChar OpenProcess PeekConsoleInputA QueryPerformanceCounter ReadConsoleInputA ReadProcessMemory ReleaseSRWLockExclusive SetConsoleMode SetConsoleTextAttribute SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW WakeAllConditionVariable WideCharToMultiByte WriteProcessMemory

user32

GetTopWindow GetWindow GetWindowTextW GetWindowThreadProcessId

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uncaught_exceptions@std@@YAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Query_perf_frequency _Thrd_id _Thrd_join

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate memcpy memmove memset

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit system terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _fseeki64 _get_stream_buffer_pointers _set_fmode fclose fflush fgetc fgetpos fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-string-l1-1-0

strcmp strlen wcscmp wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_138a7e15dda7e7c038d46f437a7bfa0e_cobalt-strike_mespinoza_satacom

kernel32

user32

msvcp140

vcruntime140

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

generic