2026-08-02_c5a5f1c62f18e6740c436cde9a85d4cd_cobalt-strike_conti_elex_glassworm_hijackloader_vidar

General

Target
2026-08-02_c5a5f1c62f18e6740c436cde9a85d4cd_cobalt-strike_conti_elex_glassworm_hijackloader_vidar
Size 787KB
Sample260802-c45pdsca79
SHA256 88aa437745c0bc70e7722a2c4db0f313795ae87fe42b1637fb1dbde32df4786a
MD5 c5a5f1c62f18e6740c436cde9a85d4cd
SHA1 dc5b43a4167a703812c59e26c3cd9ed231f659d3
SHA512 1404d9b0885e4a4c4d8246656b2271ab4de6a27d3cc5bc41f9c1e5d39eb81375beb2272eae7307b2488d54e02a380a341d2b552ad678e9a68c8a83e739acefd4
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyq9:J/sCv7QExqatgl8beJTTx0yFyq9
TLSH
T18F054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_c5a5f1c62f18e6740c436cde9a85d4cd_cobalt-strike_conti_elex_glassworm_hijackloader_vidar

2026-08-02_c5a5f1c62f18e6740c436cde9a85d4cd_cobalt-strike_conti_elex_glassworm_hijackloader_vidar

.exe 787KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 88aa437745c0bc70e7722a2c4db0f313795ae87fe42b1637fb1dbde32df4786a
MD5 c5a5f1c62f18e6740c436cde9a85d4cd
SHA1 dc5b43a4167a703812c59e26c3cd9ed231f659d3
SHA512 1404d9b0885e4a4c4d8246656b2271ab4de6a27d3cc5bc41f9c1e5d39eb81375beb2272eae7307b2488d54e02a380a341d2b552ad678e9a68c8a83e739acefd4
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyq9:J/sCv7QExqatgl8beJTTx0yFyq9
TLSH
T18F054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BC9B6D2F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths