2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260804-2walqasdnd
SHA256 482bb352041924596fcbd2a5a61aa2f44d6af8dd4b49d6ee20d785ddb1d0e9c3
MD5 5f78b9e86bc20e2e2a477fb8a831afbf
SHA1 9c1296fec6cf12de9c2efd21852c4a777eeb9100
SHA512 c990fdcf04ade6906b62953f311a9a0227f91103105530840b87351cc7ed53f972674bc0cbe66952e0fc490601ddd5a395635be5ab87409062be075f10400b57
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjvp:KIifqFu1//IifqFuyDA54GX79lSsCjvp
TLSH
T1AFF48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader

2026-08-04_5f78b9e86bc20e2e2a477fb8a831afbf_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 482bb352041924596fcbd2a5a61aa2f44d6af8dd4b49d6ee20d785ddb1d0e9c3
MD5 5f78b9e86bc20e2e2a477fb8a831afbf
SHA1 9c1296fec6cf12de9c2efd21852c4a777eeb9100
SHA512 c990fdcf04ade6906b62953f311a9a0227f91103105530840b87351cc7ed53f972674bc0cbe66952e0fc490601ddd5a395635be5ab87409062be075f10400b57
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjvp:KIifqFu1//IifqFuyDA54GX79lSsCjvp
TLSH
T1AFF48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths