2026-08-02_f829abf7b726a0bafc1dcf0366f4e9db_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-02_f829abf7b726a0bafc1dcf0366f4e9db_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260802-tk1d1acd75
SHA256 a2fa6ec13a9090b2a3ac03139ea289d931e2a76b8a724443e2fe695c8a5b9640
MD5 f829abf7b726a0bafc1dcf0366f4e9db
SHA1 d7e7e32762689830a1318f0b0c6192849c7fbcec
SHA512 7628ec3afed29c0a5f16c91761cfa62f6cd7f5a148889b5299c888e04d624c014bb82a003f6ee875826d5d5c926d708e0ee2814c0e5763b3b3f20ab4682dda51
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGqp:KIifqFu1//IifqFuyDA54GX79lSzQGqp
TLSH
T1DAF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_f829abf7b726a0bafc1dcf0366f4e9db_cobalt-strike_conti_elex_hijackloader

2026-08-02_f829abf7b726a0bafc1dcf0366f4e9db_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 a2fa6ec13a9090b2a3ac03139ea289d931e2a76b8a724443e2fe695c8a5b9640
MD5 f829abf7b726a0bafc1dcf0366f4e9db
SHA1 d7e7e32762689830a1318f0b0c6192849c7fbcec
SHA512 7628ec3afed29c0a5f16c91761cfa62f6cd7f5a148889b5299c888e04d624c014bb82a003f6ee875826d5d5c926d708e0ee2814c0e5763b3b3f20ab4682dda51
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGqp:KIifqFu1//IifqFuyDA54GX79lSzQGqp
TLSH
T1DAF48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths