2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar

General

Target
2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar
Size 838KB
Sample260802-tk9yfastev
SHA256 f9feff50f6d7c3d61cd5919f14cd80fe242e0ee9ff170299f007eafa60b3d54f
MD5 f79339a2142d990b7341bedbf5fa5152
SHA1 042d3fef86e69bbc62a9f78f1cca7b597a11a143
SHA512 15092d0908fa0908f9d8310e9592c120184ca9fb61cd649ecd8ada1632d954e1af272fe6e915a79b2bcc770ebf492e66048067c7fbb1d37f09ee04e568834023
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3z:KIifqFu1//IifqFuyDA54GX79lSqSD
TLSH
T17F054B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar

2026-08-02_f79339a2142d990b7341bedbf5fa5152_cobalt-strike_conti_elex_hijackloader_vidar

.exe 838KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 f9feff50f6d7c3d61cd5919f14cd80fe242e0ee9ff170299f007eafa60b3d54f
MD5 f79339a2142d990b7341bedbf5fa5152
SHA1 042d3fef86e69bbc62a9f78f1cca7b597a11a143
SHA512 15092d0908fa0908f9d8310e9592c120184ca9fb61cd649ecd8ada1632d954e1af272fe6e915a79b2bcc770ebf492e66048067c7fbb1d37f09ee04e568834023
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSqDXsf3z:KIifqFu1//IifqFuyDA54GX79lSqSD
TLSH
T17F054B06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths