2026-05-25_b7cff32a777d78e9cf3d1e0e2a080276_cobalt-strike_elex_hijackloader_mespinoza_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-25_b7cff32a777d78e9cf3d1e0e2a080276_cobalt-strike_elex_hijackloader_mespinoza_vidar
Size 764KB
Sample260525-snjd8aft21
SHA256 24d1be082a5ac70b551d7ad1f3937e62e2c636d4dfa2f8cf9ae809d73e32b40e
MD5 b7cff32a777d78e9cf3d1e0e2a080276
SHA1 e31a574a14acb63b38d7d371c7a91d68c1bd0615
SHA512 1f90a6b9b6ce9a6862df77faef93d379e7a59dab8823f4b41b3c319df712f99b9fa6c1e0c1e28f6f8ed8bc7eb58c7609e4ab97b0855af20fda9d001f41ef7caa
SSDEEP 12288:dDPdMWuatuPtXmMf0dBKwZC2tDclf08CWV7q9zGImAjJdcH4j3ttzFdVCLNSfHoS:pdx5tul2Mf0dYwZCUyTV7uNRjr4CFTl
TLSH
T1C9F4E12376D440F6C66342358DEA732AEBBEB562172183CF2798071D1FA25D1BE39316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-25_b7cff32a777d78e9cf3d1e0e2a080276_cobalt-strike_elex_hijackloader_mespinoza_vidar

File Explorer

2026-05-25_b7cff32a777d78e9cf3d1e0e2a080276_cobalt-strike_elex_hijackloader_mespinoza_vidar

.exe 764KB

2026-05-25_b7cff32a777d78e9cf3d1e0e2a080276_cobalt-strike_elex_hijackloader_mespinoza_vidar

IMPHASH 583f9312e901b4f30064bf5c3d929a53
SHA256 24d1be082a5ac70b551d7ad1f3937e62e2c636d4dfa2f8cf9ae809d73e32b40e
MD5 b7cff32a777d78e9cf3d1e0e2a080276
SHA1 e31a574a14acb63b38d7d371c7a91d68c1bd0615
SHA512 1f90a6b9b6ce9a6862df77faef93d379e7a59dab8823f4b41b3c319df712f99b9fa6c1e0c1e28f6f8ed8bc7eb58c7609e4ab97b0855af20fda9d001f41ef7caa
SSDEEP 12288:dDPdMWuatuPtXmMf0dBKwZC2tDclf08CWV7q9zGImAjJdcH4j3ttzFdVCLNSfHoS:pdx5tul2Mf0dYwZCUyTV7uNRjr4CFTl
TLSH
T1C9F4E12376D440F6C66342358DEA732AEBBEB562172183CF2798071D1FA25D1BE39316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29985

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\Target\x86\ship\filters\x-none\fltldr.pdb

gdi32

SetEnhMetaFileBits GetEnhMetaFileBits DeleteEnhMetaFile SetMetaFileBitsEx GetMetaFileBitsEx DeleteMetaFile

kernel32

GetModuleFileNameA IsWow64Process QueryDepthSList InterlockedPushEntrySList TryEnterCriticalSection GetProcessAffinityMask WerUnregisterMemoryBlock QueryFullProcessImageNameW OpenProcess ReleaseMutex WaitForMultipleObjects RtlCaptureStackBackTrace InterlockedPopEntrySList CreateThread WaitForMultipleObjectsEx GetTickCount64 GetThreadIOPendingFlag GetCurrentThread PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort GetModuleFileNameW GetShortPathNameA OutputDebugStringA CreateMemoryResourceNotification GetModuleHandleA LoadLibraryW EncodePointer DecodePointer FormatMessageW SetLastError RaiseFailFastException MultiByteToWideChar FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObjectEx CreateEventExW GetCurrentThreadId GetEnvironmentVariableW CreateFileW ReadFile WriteFile WaitForSingleObject GetCurrentProcess TerminateProcess QueryPerformanceCounter GetProcessHeap HeapSetInformation GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount VirtualProtect WerRegisterMemoryBlock CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException GetSystemInfo VirtualQuery FreeLibrary LoadLibraryExA IsSystemResumeAutomatic GetSystemPowerStatus GetVersionExW CreateMutexA CreateEventA OpenEventA OpenMutexA CreateSemaphoreA OpenSemaphoreA CreateFileMappingA OpenFileMappingA GlobalAlloc GlobalFree HeapAlloc HeapFree LocalAlloc LocalFree SetWaitableTimerEx CancelWaitableTimer CreateWaitableTimerW LoadResource SizeofResource WideCharToMultiByte GetCommandLineW LoadLibraryExW GetProcAddress GetModuleHandleW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetLastError CloseHandle Sleep FindResourceW

vcruntime140

memset __telemetry_main_invoke_trigger memcpy __std_type_info_name __std_terminate memcmp __CxxFrameHandler3 memmove wcsrchr wcschr __telemetry_main_return_trigger __vcrt_InitializeCriticalSectionEx _except_handler4_common _CxxThrowException

msvcp140

_Thrd_id ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ _Thrd_sleep _Xtime_get_ticks

api-ms-win-crt-runtime-l1-1-0

_get_narrow_winmain_command_line _initialize_narrow_environment _initterm _initterm_e _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn exit _exit _clearfp terminate _cexit _c_exit _register_thread_local_exe_atexit_callback _controlfp_s _crt_atexit _errno _invalid_parameter_noinfo _initialize_onexit_table _register_onexit_function _configure_narrow_argv

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscpy_s strncpy_s strnlen strcpy_s wcscmp wcsnlen isdigit

api-ms-win-crt-heap-l1-1-0

malloc realloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __p__commode _set_fmode __stdio_common_vswprintf __stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise _libm_sse2_exp_precise __setusermatherr _except1

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegCloseKey EventUnregister EventRegister EventWrite RevertToSelf RegCreateKeyExW RegOpenKeyExW OpenThreadToken CopySid GetLengthSid GetSidSubAuthority IsValidSid AddAccessAllowedAce AddAccessDeniedAce AllocateAndInitializeSid CreateWellKnownSid EqualSid FreeSid GetSecurityDescriptorDacl InitializeAcl

ole32

CoRevokeInitializeSpy CoRegisterInitializeSpy CoUninitialize CoCreateGuid CoInitializeEx

Name

.text

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-25_b7cff32a777d78e9cf3d1e0e2a080276_cobalt-strike_elex_hijackloader_mespinoza_vidar

gdi32

kernel32

vcruntime140

msvcp140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

advapi32

ole32

generic