2026-11-09_2e5268e5cc3d5c1cb8ec82b5816ad230_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_2e5268e5cc3d5c1cb8ec82b5816ad230_cobalt-strike_mespinoza_satacom
Size 1.1MB
Sample261110-3m1bfssv3m
SHA256 f7f8cfa61b863805b2a1cedf99304be96c07fd84a5418bb440fe05c9748e9506
MD5 2e5268e5cc3d5c1cb8ec82b5816ad230
SHA1 98163bff2a8b1b130ee7ee7b58fd643caac0bb29
SHA512 182bb83650af27920ec37ef37094a9db372ac01405c58b060069c5385e0c8bc78405ee088b89ceeeff0889eaaddc82bdde7c836c69752ac30170956cb31fe46a
SSDEEP 24576:m3hJlEe0wK4jlPN/2Osw9vO36tNQ1vt2:m3hJKe0wbbVFOqI1vU
TLSH
T132354C167B0A68BEC9C6C4B4978789A31E1030CF1B75BCEF46C596393EAA5F40F39614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_2e5268e5cc3d5c1cb8ec82b5816ad230_cobalt-strike_mespinoza_satacom

File Explorer

2026-11-09_2e5268e5cc3d5c1cb8ec82b5816ad230_cobalt-strike_mespinoza_satacom

.exe 1.1MB

2026-11-09_2e5268e5cc3d5c1cb8ec82b5816ad230_cobalt-strike_mespinoza_satacom

IMPHASH e108ce0fa019de5ff57ee1aec6c53ddc
SHA256 f7f8cfa61b863805b2a1cedf99304be96c07fd84a5418bb440fe05c9748e9506
MD5 2e5268e5cc3d5c1cb8ec82b5816ad230
SHA1 98163bff2a8b1b130ee7ee7b58fd643caac0bb29
SHA512 182bb83650af27920ec37ef37094a9db372ac01405c58b060069c5385e0c8bc78405ee088b89ceeeff0889eaaddc82bdde7c836c69752ac30170956cb31fe46a
SSDEEP 24576:m3hJlEe0wK4jlPN/2Osw9vO36tNQ1vt2:m3hJKe0wbbVFOqI1vU
TLSH
T132354C167B0A68BEC9C6C4B4978789A31E1030CF1B75BCEF46C596393EAA5F40F39614
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

867616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringOrdinal CreateDirectoryW CreateFile2 CreateFileW CreateMutexExW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesExW GetFileInformationByHandleEx GetFullPathNameW GetLastError GetLocaleInfoEx GetModuleHandleW GetSystemTimeAsFileTime InitOnceBeginInitialize InitOnceComplete InitializeSListHead K32GetProcessMemoryInfo LCMapStringEx LocalFree MoveFileExW MultiByteToWideChar QueryPerformanceCounter ReleaseMutex ReleaseSRWLockExclusive SetFileInformationByHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??0task_continuation_context@Concurrency@@AEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?eof@ios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uncaught_exceptions@std@@YAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Cnd_broadcast _Cnd_do_broadcast_at_thread_exit _Cnd_register_at_thread_exit _Cnd_unregister_at_thread_exit _Cnd_wait _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Thrd_hardware_concurrency _Thrd_id _Thrd_join

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

user32

CharLowerBuffW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate _purecall memcmp memcpy memmove memset

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf _fseeki64 _get_stream_buffer_pointers _set_fmode fclose fflush fgetc fgetpos fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _errno _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _dsign ceilf ldexp

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-string-l1-1-0

isprint strlen wcslen

api-ms-win-crt-convert-l1-1-0

strtod strtold strtoll strtoul strtoull

Name

.text

Size

846KB

Virtual Size

845KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_2e5268e5cc3d5c1cb8ec82b5816ad230_cobalt-strike_mespinoza_satacom

kernel32

msvcp140

msvcp140_atomic_wait

user32

advapi32

vcruntime140

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic