2026-05-27_d162103150be73e21f32c4eb13d08b33_cobalt-strike_elex_hijackloader_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-27_d162103150be73e21f32c4eb13d08b33_cobalt-strike_elex_hijackloader_mespinoza
Size 295KB
Sample260527-r2eshsat21
SHA256 96ce0c450a3b8af7fbdcde5992af86fc1d5cd9815eb1b0c2daa5eac5158cffd9
MD5 d162103150be73e21f32c4eb13d08b33
SHA1 aa5035a75d233f794237c9bb94cbb36d123f4520
SHA512 a665ac0c480eac7fd2891ae053f92099200d1c99f65a48af257511f6a7a71904121909c300c28f569ff16056cc604a1b7e1bf516c3b95e1a3baed4307ef1ddba
SSDEEP 6144:McUeiWSe7V2To/kcNdEfCfgKDpooovEb8SZ9PW:qWhQTo/FNGqfgOooo8p9PW
TLSH
T15D546C4B77A54CF2E5978174C965A772F6B6B8A11E20C70F1361C76F2F236A0AD2C312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-27_d162103150be73e21f32c4eb13d08b33_cobalt-strike_elex_hijackloader_mespinoza

File Explorer

2026-05-27_d162103150be73e21f32c4eb13d08b33_cobalt-strike_elex_hijackloader_mespinoza

.exe 295KB

2026-05-27_d162103150be73e21f32c4eb13d08b33_cobalt-strike_elex_hijackloader_mespinoza

IMPHASH a5ff5cc8103c0359bb81c31b56602e37
SHA256 96ce0c450a3b8af7fbdcde5992af86fc1d5cd9815eb1b0c2daa5eac5158cffd9
MD5 d162103150be73e21f32c4eb13d08b33
SHA1 aa5035a75d233f794237c9bb94cbb36d123f4520
SHA512 a665ac0c480eac7fd2891ae053f92099200d1c99f65a48af257511f6a7a71904121909c300c28f569ff16056cc604a1b7e1bf516c3b95e1a3baed4307ef1ddba
SSDEEP 6144:McUeiWSe7V2To/kcNdEfCfgKDpooovEb8SZ9PW:qWhQTo/FNGqfgOooo8p9PW
TLSH
T15D546C4B77A54CF2E5978174C965A772F6B6B8A11E20C70F1361C76F2F236A0AD2C312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14417

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\Target\x86\ship\lync\x-none\appsharinghookcontroller.pdb

advapi32

TraceMessage

kernel32

LoadLibraryExW LoadLibraryW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent CloseHandle WerRegisterMemoryBlock GetTickCount GetProcAddress GetCurrentThreadId GetCurrentProcessId HeapSetInformation OutputDebugStringW IsDebuggerPresent QueryPerformanceCounter GetCurrentProcess LoadLibraryExA FreeLibrary VirtualQuery VirtualProtect GetSystemInfo GetModuleHandleW GetModuleHandleA GetModuleFileNameW SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException OutputDebugStringA IsProcessorFeaturePresent InitializeSListHead GetSystemTimeAsFileTime

vcruntime140

_except_handler4_common __vcrt_InitializeCriticalSectionEx memmove _CxxThrowException __telemetry_main_invoke_trigger __telemetry_main_return_trigger __CxxFrameHandler3 memset memcpy

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _set_app_type _seh_filter_exe exit _register_onexit_function _exit __p___wargv _initterm_e _c_exit _register_thread_local_exe_atexit_callback _initterm terminate _errno _invalid_parameter_noinfo _initialize_onexit_table _get_initial_wide_environment _cexit _controlfp_s _crt_atexit _initialize_wide_environment __p___argc

api-ms-win-crt-heap-l1-1-0

_recalloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf __stdio_common_vswprintf_s _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-27_d162103150be73e21f32c4eb13d08b33_cobalt-strike_elex_hijackloader_mespinoza

advapi32

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic