2026-10-26_6a9a7cd1ccc9b74211eef34145871b0b_cobalt-strike_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_6a9a7cd1ccc9b74211eef34145871b0b_cobalt-strike_elex_mespinoza
Size 132KB
Sample261027-spnekavvbx
SHA256 af7216adc309a537a2919cac8bc99a3c3f061903408e064863fd80e129f8ff81
MD5 6a9a7cd1ccc9b74211eef34145871b0b
SHA1 da0fba758b4e069a05bdf2f4808f4ede0a5d68b4
SHA512 609509d561115f77d8b27b4ad73823b5be9bdc98b85c34167578f9d3650a91d178ad9f4218db49b45cb97111200f56c26e81dc58308d23c077f0e2f5d15851f7
SSDEEP 3072:/oERiu7o3X3LbQIyVRhiF/yeFpsn2agzMIZgAeRToBohQ5bKAU1JmUDwk:A4riF/yeHsn2fZb5AmKn
TLSH
T1B3D339433F84D5F2E44682F4258CD37E9A79EA196F028AE3C7859EE919E53C11CB10F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_6a9a7cd1ccc9b74211eef34145871b0b_cobalt-strike_elex_mespinoza

.exe 132KB

2026-10-26_6a9a7cd1ccc9b74211eef34145871b0b_cobalt-strike_elex_mespinoza

IMPHASH f24abeee63fa62eae6da3244cb6b1c19
SHA256 af7216adc309a537a2919cac8bc99a3c3f061903408e064863fd80e129f8ff81
MD5 6a9a7cd1ccc9b74211eef34145871b0b
SHA1 da0fba758b4e069a05bdf2f4808f4ede0a5d68b4
SHA512 609509d561115f77d8b27b4ad73823b5be9bdc98b85c34167578f9d3650a91d178ad9f4218db49b45cb97111200f56c26e81dc58308d23c077f0e2f5d15851f7
SSDEEP 3072:/oERiu7o3X3LbQIyVRhiF/yeFpsn2agzMIZgAeRToBohQ5bKAU1JmUDwk:A4riF/yeHsn2fZb5AmKn
TLSH
T1B3D339433F84D5F2E44682F4258CD37E9A79EA196F028AE3C7859EE919E53C11CB10F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

34:9b:64:6e:30:53:ba:46:0f:e6:8a:5a:d9:31:3b:83:73:ae:d3:f1:7a:11:e0:e8:3c:1a:43:cd:ab:44:06:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tensor Company Ltd,O=Tensor Company Ltd,L=Yaroslavl,ST=Yaroslavskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c0f61646d696e4074656e736f722e7275

Chains

Oct 22, 2026

CN=Tensor Company Ltd,O=Tensor Company Ltd,L=Yaroslavl,ST=Yaroslavskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c0f61646d696e4074656e736f722e7275

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=Tensor Company Ltd,O=Tensor Company Ltd,L=Yaroslavl,ST=Yaroslavskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c0f61646d696e4074656e736f722e7275

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=Tensor Company Ltd,O=Tensor Company Ltd,L=Yaroslavl,ST=Yaroslavskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c0f61646d696e4074656e736f722e7275

Serial Number

55:20:ed:9c:3c:3b:fb:80:73:58:9a:3d

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2024 - Jul 17, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

93867

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

sbis-updater-center-config-fixer.pdb

sbis-lib300

??$Set@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Config@sbis@@QAE_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0W4ConfigLayer@1@@Z ??0?$ArrayView@_W@sbis@@QAE@PB_WI@Z ??0?$BasicStringView@_W@detail@sbis@@QAE@PB_W@Z ??0DeStringifyError@sbis@@QAE@ABV01@@Z ??0DeStringifyError@sbis@@QAE@HABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z ??0Exception@sbis@@QAE@ABV01@@Z ??0IniParser@sbis@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N1@Z ??0LogRecord@log@sbis@@AAE@W4LogLevel@logging@2@@Z ??0NamedMutex@sbis@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??1Exception@sbis@@UAE@XZ ??1IniParser@sbis@@QAE@XZ ??1LogRecord@log@sbis@@QAE@XZ ??1NamedMutex@sbis@@QAE@XZ ?CheckKey@IniParser@sbis@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?CheckLevel@LogRecord@log@sbis@@SA_NW4LogLevel@logging@3@@Z ?CreateEmptyFile@filesystem@sbis@@YA_NABVpath@1boost@@@Z ?Data@?$Allocator@_W@sbis@@QBEPA_WXZ ?ErrorCode@Exception@sbis@@QBEHXZ ?ErrorMessage@Exception@sbis@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?ErrorUserMessage@Exception@sbis@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?ExpandEnvVars@sbis@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABVStringView@1@@Z ?FormatImpl@LogRecord@log@sbis@@AAEXIABVStringView@3@QBQBV?$LazyToStringable@_W@detail@3@IQAVToStringCachePosition@63@@Z ?FromString@?$DeStringify@V?$OptArray@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@sbis@@@sbis@@SA?AV?$OptArray@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@ABVStringView@2@@Z ?GetCurrentExecutablePath@sbis@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?Instance@Config@sbis@@SAAAV12@XZ ?IsBranch@IniParser@sbis@@QBE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?IsValid@LogRecord@log@sbis@@QBE_NXZ ?Now@LogTimestamp@log@sbis@@SA?AU123@XZ ?SetMessageType@LogRecord@log@sbis@@QAEXH@Z ?SetTimestamp@LogRecord@log@sbis@@QAEXABULogTimestamp@23@@Z ?SetValue@IniParser@sbis@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z ?Size@BasicAllocator@sbis@@QBEIXZ ?Submit@log@sbis@@YAX$$QAVLogRecord@12@@Z ?ToString@?$Stringify@H@sbis@@SAXABV?$Allocator@_W@2@H@Z ?ToString@?$Stringify@VStringView@sbis@@@sbis@@SAXABV?$Allocator@_W@2@ABVStringView@2@@Z ?ValueString@IniParser@sbis@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@0@Z ?ValueString@IniParser@sbis@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z ?WriteChanges@IniParser@sbis@@QAEXXZ ?size@?$ArrayView@_W@sbis@@QBEIXZ

msvcp140

??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z ??0_Lockit@std@@QAE@H@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ ??1_Lockit@std@@QAE@XZ ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UAEXXZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z ?_Syserror_map@std@@YAPBDH@Z ?_Throw_C_error@std@@YAXH@Z ?_Winerror_map@std@@YAHH@Z ?_Xinvalid_argument@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Mtx_destroy_in_situ _Mtx_init_in_situ _Mtx_lock _Mtx_unlock

kernel32

AreFileApisANSI CloseHandle CreateEventW CreateFileW DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection FormatMessageA FormatMessageW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetFileInformationByHandle GetLastError GetLocaleInfoEx GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LocalFree MultiByteToWideChar QueryPerformanceCounter RemoveDirectoryW ResetEvent SetEvent SetFileAttributesW SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter WaitForSingleObjectEx WideCharToMultiByte

vcruntime140

_CxxThrowException __CxxFrameHandler3 __RTDynamicCast __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate _except_handler4_common _purecall memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _controlfp_s _crt_atexit _errno _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit strerror terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen strncpy wcslen

api-ms-win-crt-convert-l1-1-0

wcstol

Name

.text

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_6a9a7cd1ccc9b74211eef34145871b0b_cobalt-strike_elex_mespinoza

sbis-lib300

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic