2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260802-q73k4atgrf
SHA256 998065edb22246dd377839f749bd43d5dcd24246c0cd9ea7890dca92831a563d
MD5 a96a5dbc355564874930eb93b5345ccd
SHA1 affe6eb56377509e85be3e01194ed1fa5abd48c0
SHA512 12c55ec90b58b8465b58c20b5aaf46df997da119b593e274e9966b6f33ab56a8abe631a1b827aae813342723925ab7d0229dca49c54accee0a0cdcca33ef8fdb
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQMf6:KIifqFu1//IifqFuyDA54GX79lSzQMf6
TLSH
T194F48E07E6E244FCD517C17089E69372EA71FC225620AB7F2768E6213F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader

2026-08-02_a96a5dbc355564874930eb93b5345ccd_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 998065edb22246dd377839f749bd43d5dcd24246c0cd9ea7890dca92831a563d
MD5 a96a5dbc355564874930eb93b5345ccd
SHA1 affe6eb56377509e85be3e01194ed1fa5abd48c0
SHA512 12c55ec90b58b8465b58c20b5aaf46df997da119b593e274e9966b6f33ab56a8abe631a1b827aae813342723925ab7d0229dca49c54accee0a0cdcca33ef8fdb
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQMf6:KIifqFu1//IifqFuyDA54GX79lSzQMf6
TLSH
T194F48E07E6E244FCD517C17089E69372EA71FC225620AB7F2768E6213F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths