2026-10-06_940894918fdc0f54bf22499388bc020c_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_940894918fdc0f54bf22499388bc020c_cobalt-strike_mespinoza_satacom
Size 1.4MB
Sample261007-29gl7axshs
SHA256 2928ac5585496fcb872bde4e4931f874df8af2071f023059df8e4bd3960708b4
MD5 940894918fdc0f54bf22499388bc020c
SHA1 485cfe1dc8028e31d7a1f6d38be322890568185f
SHA512 69680ee1e28fa4f6f4d308de8592d513c3909aa59e7a4c5c808064b5a6f5ae4511d92352919ecc2e4cbff269907c62a0c5e37af0d154b9a4b2026ca0ec10dc0a
SSDEEP 24576:iR1H9kO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iR1H9TLNiXicJFFRGNzj3
TLSH
T1DE650113F54950F6E55CD4388B828121FAB27C854B21A9EF63442D752EB9FE8FB3D212
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_940894918fdc0f54bf22499388bc020c_cobalt-strike_mespinoza_satacom

File Explorer

2026-10-06_940894918fdc0f54bf22499388bc020c_cobalt-strike_mespinoza_satacom

.exe 1.4MB

2026-10-06_940894918fdc0f54bf22499388bc020c_cobalt-strike_mespinoza_satacom

IMPHASH 3e75f301bb45a30d5586c186ff98c0f5
SHA256 2928ac5585496fcb872bde4e4931f874df8af2071f023059df8e4bd3960708b4
MD5 940894918fdc0f54bf22499388bc020c
SHA1 485cfe1dc8028e31d7a1f6d38be322890568185f
SHA512 69680ee1e28fa4f6f4d308de8592d513c3909aa59e7a4c5c808064b5a6f5ae4511d92352919ecc2e4cbff269907c62a0c5e37af0d154b9a4b2026ca0ec10dc0a
SSDEEP 24576:iR1H9kO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iR1H9TLNiXicJFFRGNzj3
TLSH
T1DE650113F54950F6E55CD4388B828121FAB27C854B21A9EF63442D752EB9FE8FB3D212
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

plugin-container.pdb

mozglue

??2@YAPEAX_K@Z ??3@YAXPEAX@Z ??3@YAXPEAX_K@Z ??_U@YAPEAX_K@Z ??_V@YAXPEAX@Z ?DllBlocklist_Initialize@@YAXI@Z ?InvalidArrayIndex_CRASH@detail@mozilla@@YAX_K0@Z ?IsWin32kLockedDown@mozilla@@YA_NXZ ?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?SetGeckoChildID@mozilla@@YAXPEBD@Z ?SetGeckoProcessType@mozilla@@YAXPEBD@Z ?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A calloc free malloc moz_xmalloc mozalloc_abort realloc strdup

advapi32

AddMandatoryAce GetAce GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo InitializeAcl IsValidAcl IsValidSecurityDescriptor IsValidSid OpenProcessToken RegCloseKey RegDisablePredefinedCache RegOpenKeyExW RevertToSelf SetKernelObjectSecurity SetSecurityInfo SetTokenInformation

ntdll

NtQueryVirtualMemory RtlAddFunctionTable RtlLookupFunctionEntry RtlNtStatusToDosError RtlSetLastWin32Error

msvcp140

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetLastError GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProductInfo GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSectionEx InitializeSListHead IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryW LocalFree QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive SetDefaultDllDirectories SetDllDirectoryW SetEnvironmentVariableW SetHandleInformation SetLastError SetProcessMitigationPolicy SetThreadAffinityMask SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsGetValue TlsSetValue TryAcquireSRWLockExclusive VirtualAlloc VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte

vcruntime140

__C_specific_handler __current_exception __current_exception_context memchr memcpy memmove memset strrchr

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr _dsign ceilf frexp ldexp nan nanf

api-ms-win-crt-string-l1-1-0

_wcsnicmp strlen wcslen wcsncmp

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

GetHandleVerifier IsSandboxedProcess TargetCreateThread TargetCreateThread64 TargetGdiDllInitialize TargetGdiDllInitialize64 TargetGetForegroundWindow TargetGetForegroundWindow64 TargetGetStockObject TargetGetStockObject64 TargetNtCreateFile TargetNtCreateFile64 TargetNtCreateKey TargetNtCreateKey64 TargetNtCreateSection TargetNtCreateSection64 TargetNtImpersonateAnonymousToken TargetNtImpersonateAnonymousToken64 TargetNtMapViewOfSection TargetNtMapViewOfSection64 TargetNtOpenFile TargetNtOpenFile64 TargetNtOpenKey TargetNtOpenKey64 TargetNtOpenKeyEx TargetNtOpenKeyEx64 TargetNtOpenProcess TargetNtOpenProcess64 TargetNtOpenProcessToken TargetNtOpenProcessToken64 TargetNtOpenProcessTokenEx TargetNtOpenProcessTokenEx64 TargetNtOpenSection TargetNtOpenSection64 TargetNtOpenThread TargetNtOpenThread64 TargetNtOpenThreadToken TargetNtOpenThreadToken64 TargetNtOpenThreadTokenEx TargetNtOpenThreadTokenEx64 TargetNtQueryAttributesFile TargetNtQueryAttributesFile64 TargetNtQueryFullAttributesFile TargetNtQueryFullAttributesFile64 TargetNtSetInformationFile TargetNtSetInformationFile64 TargetNtSetInformationThread TargetNtSetInformationThread64 TargetNtUnmapViewOfSection TargetNtUnmapViewOfSection64 TargetRegisterClassW TargetRegisterClassW64 g_current_mitigations g_delegate_data_size g_handle_closer_info g_interceptions g_nt g_originals g_sentinel_value_end g_sentinel_value_start g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section g_shared_startup_mitigations

Name

.text

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_940894918fdc0f54bf22499388bc020c_cobalt-strike_mespinoza_satacom

mozglue

advapi32

ntdll

msvcp140

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic