2026-10-14_c22c3dd3cfed2e9f8958097ace8fbd67_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_c22c3dd3cfed2e9f8958097ace8fbd67_cobalt-strike_mespinoza_satacom
Size 1.3MB
Sample261014-pytfdsgc34
SHA256 f121886ab9eae784a1b9068f63a6b824a43a2d0564f8b2ca47217d1345529f37
MD5 c22c3dd3cfed2e9f8958097ace8fbd67
SHA1 427abb2a186dda689fb618292aa5de05594735c9
SHA512 f5afa1ba2d8fd511154b251950d91e622ace7706dc28e6a198fae5e4e295c6ebcc9d5d141fdd0172459e00262ac56bdc8f63e503e9d7a26f1df37162b733c0f3
SSDEEP 24576:LM7Y7s57AEymm/HqU2PsbxkWaYiKFdu9CwJsv6tJontTthqJ:6As57Ummfqiq1KFdu9CwJsv6tC3q
TLSH
T12F552917A6E55038F2FBC57087AB1123EA727C416B2065DF828C3295D9B3AF05B3B365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_c22c3dd3cfed2e9f8958097ace8fbd67_cobalt-strike_mespinoza_satacom

File Explorer

2026-10-14_c22c3dd3cfed2e9f8958097ace8fbd67_cobalt-strike_mespinoza_satacom

.exe 1.3MB

2026-10-14_c22c3dd3cfed2e9f8958097ace8fbd67_cobalt-strike_mespinoza_satacom

IMPHASH e82a28b0d1f2edf78b5b297d94d611c1
SHA256 f121886ab9eae784a1b9068f63a6b824a43a2d0564f8b2ca47217d1345529f37
MD5 c22c3dd3cfed2e9f8958097ace8fbd67
SHA1 427abb2a186dda689fb618292aa5de05594735c9
SHA512 f5afa1ba2d8fd511154b251950d91e622ace7706dc28e6a198fae5e4e295c6ebcc9d5d141fdd0172459e00262ac56bdc8f63e503e9d7a26f1df37162b733c0f3
SSDEEP 24576:LM7Y7s57AEymm/HqU2PsbxkWaYiKFdu9CwJsv6tJontTthqJ:6As57Ummfqiq1KFdu9CwJsv6tC3q
TLSH
T12F552917A6E55038F2FBC57087AB1123EA727C416B2065DF828C3295D9B3AF05B3B365
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

627184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

W:\classic-gui\build-clang-cl\vcpkg_installed\vcpkg\blds\qtbase\x64-windows-classic-clang-cl-rel\bin\moc.pdb

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z

msvcp140_1

_Aligned_get_default_resource

kernel32

AcquireSRWLockExclusive CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW DeleteFileW DeviceIoControl FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageW GetCommandLineW GetCurrentDirectoryW GetCurrentProcessId GetCurrentThreadId GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileType GetFullPathNameW GetLastError GetLogicalDrives GetModuleHandleW GetSystemInfo GetSystemTimeAsFileTime InitializeSListHead LocalFree MapViewOfFile MoveFileExW MoveFileW QueryPerformanceCounter ReadFile ReleaseSRWLockExclusive RemoveDirectoryW SetEndOfFile SetErrorMode SetFilePointerEx SetFileTime SetUnhandledExceptionFilter SleepConditionVariableSRW SystemTimeToFileTime TzSpecificLocalTimeToSystemTime UnmapViewOfFile WakeAllConditionVariable WriteFile

shell32

CommandLineToArgvW

netapi32

NetApiBufferFree NetShareEnum

ole32

CoCreateInstance CoInitializeEx CoUninitialize

pcre2-16

pcre2_code_free_16 pcre2_jit_stack_free_16

vcruntime140

_CxxThrowException __C_specific_handler __current_exception __current_exception_context __std_exception_copy __std_exception_destroy _purecall memchr memcmp memcpy memmove memset strrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _close _fileno _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _open_osfhandle _read _set_fmode _wfopen_s _write fclose feof fflush fgets fputc fputs fread fwrite

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _errno _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit strerror terminate

api-ms-win-crt-locale-l1-1-0

_configthreadlocale _create_locale _free_locale

api-ms-win-crt-time-l1-1-0

_localtime64_s _mktime64 _tzset

api-ms-win-crt-filesystem-l1-1-0

_waccess _wchmod

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

strcmp strlen strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf trunc

Name

.text

Size

610KB

Virtual Size

610KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

711KB

Virtual Size

711KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

305B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

924B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_c22c3dd3cfed2e9f8958097ace8fbd67_cobalt-strike_mespinoza_satacom

msvcp140

msvcp140_1

kernel32

shell32

netapi32

ole32

pcre2-16

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

generic