2026-11-12_436f6eb6ea893bf8a24cbfd9457af835_cobalt-strike_mespinoza_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_436f6eb6ea893bf8a24cbfd9457af835_cobalt-strike_mespinoza_satacom
Size 837KB
Sample261113-ezyfmaf13q
SHA256 6b23f85a1e1761ba2073db06534cdd0cbd9d17d4fc5bbb082abed2a6c6f6c290
MD5 436f6eb6ea893bf8a24cbfd9457af835
SHA1 c4a92f3a265968586775d2ddf74b45834b339730
SHA512 f45348f20fec259636dd6f077a80e796b32f8649d022cc70a7aff7b636b890234b8ada64209660113693e47f12a6413aee73eb4b4a012da0c21bd91d20159212
SSDEEP 12288:LNDc/57ObhXH2edXFXU39PDSUQMQlPoErC:BDc/5ODd1XU3JSm6rC
TLSH
T1EE05E50A3AEA61ACC457C47107DA45322E7475CA1F31EDFF25A982293F79AF84A3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-12_436f6eb6ea893bf8a24cbfd9457af835_cobalt-strike_mespinoza_satacom

.exe 837KB

2026-11-12_436f6eb6ea893bf8a24cbfd9457af835_cobalt-strike_mespinoza_satacom

IMPHASH ae3a8a84dad322638ee9d22b9a29a4a0
SHA256 6b23f85a1e1761ba2073db06534cdd0cbd9d17d4fc5bbb082abed2a6c6f6c290
MD5 436f6eb6ea893bf8a24cbfd9457af835
SHA1 c4a92f3a265968586775d2ddf74b45834b339730
SHA512 f45348f20fec259636dd6f077a80e796b32f8649d022cc70a7aff7b636b890234b8ada64209660113693e47f12a6413aee73eb4b4a012da0c21bd91d20159212
SSDEEP 12288:LNDc/57ObhXH2edXFXU39PDSUQMQlPoErC:BDc/5ODd1XU3JSm6rC
TLSH
T1EE05E50A3AEA61ACC457C47107DA45322E7475CA1F31EDFF25A982293F79AF84A3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

70:0a:61:9c:52:4c:27:3b:8b:7a:81:23:d8:1b:6b:27:2b:c0:b8:bd:15:2c:b3:fd:62:2e:be:7e:de:71:81:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1237700457862,CN=Majestic Development LLC,O=Majestic Development LLC,STREET=ul Malaya Gruzinskaya\, 28 pomeshch 6/14,L=Moscow,ST=Moscow,C=RU,1.3.6.1.4.1.311.60.2.1.2=#13064d6f73636f77,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 9, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

66:e5:12:6a:bd:81:a0:22:a5:15:f3:dc

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 20, 2026 - Jul 21, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

533560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libce2

cef_api_hash cef_binary_value_create cef_dictionary_value_create cef_execute_process cef_get_min_log_level cef_get_vlog_level cef_list_value_create cef_log cef_process_message_create cef_string_list_alloc cef_string_list_append cef_string_list_free cef_string_list_size cef_string_list_value cef_string_map_alloc cef_string_map_append cef_string_map_free cef_string_map_key cef_string_map_size cef_string_map_value cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_free cef_string_multimap_key cef_string_multimap_size cef_string_multimap_value cef_string_userfree_utf16_free cef_string_utf16_clear cef_string_utf16_cmp cef_string_utf16_set cef_string_utf16_to_utf8 cef_string_utf8_clear cef_string_utf8_to_utf16 cef_v8_context_get_current_context cef_v8_value_create_array cef_v8_value_create_array_buffer cef_v8_value_create_bool cef_v8_value_create_double cef_v8_value_create_function cef_v8_value_create_int cef_v8_value_create_null cef_v8_value_create_object cef_v8_value_create_string cef_value_create

kernel32

CloseHandle CreateEventW CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetExitCodeProcess GetLastError GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEvent SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess UnhandledExceptionFilter WaitForSingleObjectEx

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Throw_C_error@std@@YAXH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Thrd_detach

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate _purecall memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_narrow_winmain_command_line _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strcmp strlen

Name

.text

Size

519KB

Virtual Size

519KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

252KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

14B

Characteristics

Name

.rsrc

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_436f6eb6ea893bf8a24cbfd9457af835_cobalt-strike_mespinoza_satacom

libce2

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

generic