2026-05-22_051176ef8a24cebad821765331760e66_cobalt-strike_elex_hijackloader_mespinoza_vidar

General

Target
2026-05-22_051176ef8a24cebad821765331760e66_cobalt-strike_elex_hijackloader_mespinoza_vidar
Size 1.1MB
Sample260522-rt4rnsdz4p
SHA256 8e7b27c316c6984f640a48026937c5213b27856e16b1b44e8c29d4060343c448
MD5 051176ef8a24cebad821765331760e66
SHA1 5fefb0a3713482881571e467759b9648471af1da
SHA512 c998b382e9823ee408a0cd8b794f01bc3556d54cc66f78b75435ef3a6a8a8eaa385c769d84148d36000ec4a451798d0e5983757a4d1f89f6ee1f603b0fb44f33
SSDEEP 24576:0+2Jm/jlSmf6KeGUcgQW/MUSdGDd4K3uk3D5Tvinrmhh5QX4FrbA:ImUi6AjW/MUSdGRf3/z56rQ5QX4q
TLSH
T1CF4518127A948A75D16B41348E51E25DA27BBC60CF134FCB22942EDDFFF1581AE28273
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_051176ef8a24cebad821765331760e66_cobalt-strike_elex_hijackloader_mespinoza_vidar

File Explorer

2026-05-22_051176ef8a24cebad821765331760e66_cobalt-strike_elex_hijackloader_mespinoza_vidar

.exe 1.1MB

2026-05-22_051176ef8a24cebad821765331760e66_cobalt-strike_elex_hijackloader_mespinoza_vidar

SHA256 8e7b27c316c6984f640a48026937c5213b27856e16b1b44e8c29d4060343c448
MD5 051176ef8a24cebad821765331760e66
SHA1 5fefb0a3713482881571e467759b9648471af1da
SHA512 c998b382e9823ee408a0cd8b794f01bc3556d54cc66f78b75435ef3a6a8a8eaa385c769d84148d36000ec4a451798d0e5983757a4d1f89f6ee1f603b0fb44f33
SSDEEP 24576:0+2Jm/jlSmf6KeGUcgQW/MUSdGDd4K3uk3D5Tvinrmhh5QX4FrbA:ImUi6AjW/MUSdGRf3/z56rQ5QX4q
TLSH
T1CF4518127A948A75D16B41348E51E25DA27BBC60CF134FCB22942EDDFFF1581AE28273
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

312099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\protocolhandler.pdb

Name

.text

Size

317KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

90KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_051176ef8a24cebad821765331760e66_cobalt-strike_elex_hijackloader_mespinoza_vidar

generic