2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom
Size 88KB
Sample261027-l1sebsb141
SHA256 6e4f7a7ba95be8ca912581eeba3dcf43e5976e4f4754c703b36e4513fe400796
MD5 a6c5940ecb25bf4f7fa16d7249187628
SHA1 97267826449cda5638f8b06584fb2ae2b1789313
SHA512 5edd7ed2c536099c7cd1ba9d60fd315e3a8d24fcc89aaaa5b655a287d359ae120ca50627977206cf0aab0cb1970e65c829066853f7718993901d4141b5c9e0bf
SSDEEP 1536:qlro1OMLCyMT/fQASaUVeEdAXy7AG8Du6+WSss/eYwp:qho1ZLCy+BUldhUY6+WSvm
TLSH
T124937C4EFF4254BDC55EC0B882A349676932B09A0F61E9CF4681D32E1E79BF41B3DA50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom

File Explorer

2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom

.exe 88KB

2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom

IMPHASH 8eb4715c9d55d5204cf806447f0cc96f
SHA256 6e4f7a7ba95be8ca912581eeba3dcf43e5976e4f4754c703b36e4513fe400796
MD5 a6c5940ecb25bf4f7fa16d7249187628
SHA1 97267826449cda5638f8b06584fb2ae2b1789313
SHA512 5edd7ed2c536099c7cd1ba9d60fd315e3a8d24fcc89aaaa5b655a287d359ae120ca50627977206cf0aab0cb1970e65c829066853f7718993901d4141b5c9e0bf
SSDEEP 1536:qlro1OMLCyMT/fQASaUVeEdAXy7AG8Du6+WSss/eYwp:qho1ZLCy+BUldhUY6+WSvm
TLSH
T124937C4EFF4254BDC55EC0B882A349676932B09A0F61E9CF4681D32E1E79BF41B3DA50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AllocConsole CloseHandle CopyFileA CreateFileA CreateToolhelp32Snapshot DeleteFileA DuplicateHandle FindClose FindFirstFileA FindNextFileA GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetModuleHandleA GetModuleHandleW GetProcAddress GetStdHandle GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTickCount InitializeSListHead LoadLibraryA MultiByteToWideChar OpenProcess OpenThread Process32FirstW Process32NextW QueryPerformanceCounter ReleaseSRWLockExclusive ResumeThread SetConsoleMode SetConsoleTitleA SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread Thread32First Thread32Next VirtualAllocEx VirtualProtectEx VirtualQueryEx WakeAllConditionVariable WriteConsoleW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fail@ios_base@std@@QEBA_NXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy memcpy memmove memset

api-ms-win-crt-stdio-l1-1-0

__p__commode _fseeki64 _get_stream_buffer_pointers _set_fmode fclose fflush fgetc fgetpos fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_a6c5940ecb25bf4f7fa16d7249187628_cobalt-strike_mespinoza_satacom

kernel32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic