2026-08-02_dba3fa16d4d055a7278816404ad1e032_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-02_dba3fa16d4d055a7278816404ad1e032_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260802-qtkhcsteng
SHA256 a968be0aa9403664339bee5fe03e0c0ed0250645c89077a42b29874cf065a4c2
MD5 dba3fa16d4d055a7278816404ad1e032
SHA1 2cd9ee667a719a1f34284bb3ab1d1aa7762f9746
SHA512 1bd0db1557f2e6953a093e2d696cdf17e5aca5c62f015534b0e8402f8036031f54bc02ae03e1e72be7950240b7c5eb9489a685d2aebd32948d7da772ec4e69f1
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHcj29:KIifqFu1//IifqFuyDA54GX79lSHcj29
TLSH
T15FF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_dba3fa16d4d055a7278816404ad1e032_cobalt-strike_conti_elex_hijackloader

2026-08-02_dba3fa16d4d055a7278816404ad1e032_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 a968be0aa9403664339bee5fe03e0c0ed0250645c89077a42b29874cf065a4c2
MD5 dba3fa16d4d055a7278816404ad1e032
SHA1 2cd9ee667a719a1f34284bb3ab1d1aa7762f9746
SHA512 1bd0db1557f2e6953a093e2d696cdf17e5aca5c62f015534b0e8402f8036031f54bc02ae03e1e72be7950240b7c5eb9489a685d2aebd32948d7da772ec4e69f1
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHcj29:KIifqFu1//IifqFuyDA54GX79lSHcj29
TLSH
T15FF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths