2026-08-02_fd5a60feec41b2c2853a8982f2c1852a_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-02_fd5a60feec41b2c2853a8982f2c1852a_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260802-tgtr2scc95
SHA256 656323754d792ca626d03547b247d656440e2e8f90b2af9239879bf51a94b46c
MD5 fd5a60feec41b2c2853a8982f2c1852a
SHA1 18d9615319c326fbf0b01674c9fbd64098ea5de0
SHA512 8a654c2ea9a29891d875d51a90ba27edb2762fd10925f0b7140ce36b21001fba6206d81e038480e5c0b34576e0d1ec5451872ea428b661fa11708a84ff6df77f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHcjbf:KIifqFu1//IifqFuyDA54GX79lSHcjbf
TLSH
T1A1F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_fd5a60feec41b2c2853a8982f2c1852a_cobalt-strike_conti_elex_hijackloader

2026-08-02_fd5a60feec41b2c2853a8982f2c1852a_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 656323754d792ca626d03547b247d656440e2e8f90b2af9239879bf51a94b46c
MD5 fd5a60feec41b2c2853a8982f2c1852a
SHA1 18d9615319c326fbf0b01674c9fbd64098ea5de0
SHA512 8a654c2ea9a29891d875d51a90ba27edb2762fd10925f0b7140ce36b21001fba6206d81e038480e5c0b34576e0d1ec5451872ea428b661fa11708a84ff6df77f
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSHcjbf:KIifqFu1//IifqFuyDA54GX79lSHcjbf
TLSH
T1A1F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F2A758
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths