2026-10-22_f44568748dbc37b2af55e3f2cb48e0d5_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_f44568748dbc37b2af55e3f2cb48e0d5_cobalt-strike_mespinoza_satacom
Size 1.4MB
Sample261023-ctys4ahs5v
SHA256 07f31cb7f8483d430a3bc892d2247fdf28cc521475a0620e88f8c85908a17023
MD5 f44568748dbc37b2af55e3f2cb48e0d5
SHA1 3ccada199b08c824e4c809d03afdb5b6dea1164f
SHA512 40b658733a766c0ad5f2790ceafec8df227e61240556ee61bac8045a6f9a450fed0352ded9f9add6cfc3f4180a15debddae531b0c5579e09b29bf4578d509df2
SSDEEP 12288:KYSkxOs2iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:TSm2inQ/tbw/2Mkjy6Fr7g0o3
TLSH
T16C650223B959A0F6E50DC9784E828112FA737CC21B21B6DF2B441D751EB97E4BB3A341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_f44568748dbc37b2af55e3f2cb48e0d5_cobalt-strike_mespinoza_satacom

File Explorer

2026-10-22_f44568748dbc37b2af55e3f2cb48e0d5_cobalt-strike_mespinoza_satacom

.exe 1.4MB

2026-10-22_f44568748dbc37b2af55e3f2cb48e0d5_cobalt-strike_mespinoza_satacom

IMPHASH b5afc887d654f6c63b0ab202964916df
SHA256 07f31cb7f8483d430a3bc892d2247fdf28cc521475a0620e88f8c85908a17023
MD5 f44568748dbc37b2af55e3f2cb48e0d5
SHA1 3ccada199b08c824e4c809d03afdb5b6dea1164f
SHA512 40b658733a766c0ad5f2790ceafec8df227e61240556ee61bac8045a6f9a450fed0352ded9f9add6cfc3f4180a15debddae531b0c5579e09b29bf4578d509df2
SSDEEP 12288:KYSkxOs2iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:TSm2inQ/tbw/2Mkjy6Fr7g0o3
TLSH
T16C650223B959A0F6E50DC9784E828112FA737CC21B21B6DF2B441D751EB97E4BB3A341
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

plugin-container.pdb

mozglue

??0AutoSuppressStackWalking@@QEAA@XZ ??1AutoSuppressStackWalking@@QEAA@XZ ??2@YAPEAX_K@Z ??3@YAXPEAX@Z ??3@YAXPEAX_K@Z ??_U@YAPEAX_K@Z ??_V@YAXPEAX@Z ?DllBlocklist_Initialize@@YAXI@Z ?InvalidArrayIndex_CRASH@detail@mozilla@@YAX_K0@Z ?IsWin32kLockedDown@mozilla@@YA_NXZ ?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?SetGeckoChildID@mozilla@@YAXPEBD@Z ?SetGeckoProcessType@mozilla@@YAXPEBD@Z ?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A calloc free malloc moz_xmalloc mozalloc_abort realloc strdup

advapi32

AddMandatoryAce GetAce GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo InitializeAcl IsValidAcl IsValidSecurityDescriptor IsValidSid OpenProcessToken RegCloseKey RegDisablePredefinedCache RegOpenKeyExW RevertToSelf SetKernelObjectSecurity SetSecurityInfo SetTokenInformation

ntdll

NtQueryVirtualMemory RtlAddFunctionTable RtlLookupFunctionEntry RtlNtStatusToDosError RtlSetLastWin32Error

msvcp140

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetLastError GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProductInfo GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSectionEx InitializeSListHead IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryW LocalFree QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive SetDefaultDllDirectories SetDllDirectoryW SetEnvironmentVariableW SetHandleInformation SetLastError SetProcessMitigationPolicy SetThreadAffinityMask SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsGetValue TlsSetValue TryAcquireSRWLockExclusive VirtualAlloc VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte

vcruntime140

__C_specific_handler __current_exception __current_exception_context memchr memcpy memmove memset strrchr

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr _dsign ceilf frexp ldexp nan nanf

api-ms-win-crt-string-l1-1-0

_wcsnicmp strlen wcslen wcsncmp

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

GetHandleVerifier IsSandboxedProcess TargetCreateThread TargetCreateThread64 TargetGdiDllInitialize TargetGdiDllInitialize64 TargetGetForegroundWindow TargetGetForegroundWindow64 TargetGetStockObject TargetGetStockObject64 TargetNtCreateFile TargetNtCreateFile64 TargetNtCreateKey TargetNtCreateKey64 TargetNtCreateSection TargetNtCreateSection64 TargetNtImpersonateAnonymousToken TargetNtImpersonateAnonymousToken64 TargetNtMapViewOfSection TargetNtMapViewOfSection64 TargetNtOpenFile TargetNtOpenFile64 TargetNtOpenKey TargetNtOpenKey64 TargetNtOpenKeyEx TargetNtOpenKeyEx64 TargetNtOpenProcess TargetNtOpenProcess64 TargetNtOpenProcessToken TargetNtOpenProcessToken64 TargetNtOpenProcessTokenEx TargetNtOpenProcessTokenEx64 TargetNtOpenSection TargetNtOpenSection64 TargetNtOpenThread TargetNtOpenThread64 TargetNtOpenThreadToken TargetNtOpenThreadToken64 TargetNtOpenThreadTokenEx TargetNtOpenThreadTokenEx64 TargetNtQueryAttributesFile TargetNtQueryAttributesFile64 TargetNtQueryFullAttributesFile TargetNtQueryFullAttributesFile64 TargetNtSetInformationFile TargetNtSetInformationFile64 TargetNtSetInformationThread TargetNtSetInformationThread64 TargetNtUnmapViewOfSection TargetNtUnmapViewOfSection64 TargetRegisterClassW TargetRegisterClassW64 g_current_mitigations g_delegate_data_size g_handle_closer_info g_interceptions g_nt g_originals g_sentinel_value_end g_sentinel_value_start g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section g_shared_startup_mitigations

Name

.text

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_f44568748dbc37b2af55e3f2cb48e0d5_cobalt-strike_mespinoza_satacom

mozglue

advapi32

ntdll

msvcp140

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic