2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260804-rnpessyzes
SHA256 ce7b483b6cb98e5eeda17dee9b645fe14b410d350f1d3299c9fb360260dd25e5
MD5 bf046b6fe2980f03275448239a062a24
SHA1 bdd7b06807fd03fb4aba039f8016f3e57b1cdf27
SHA512 d8a632f8c45ead3c056f84fc0c7ac41d4092f7136e4afda9f0d5b10c358f35f8f0ad71aeaca1d56011af74800aa910c47bdcb10c7793cc787fc8b853352b6b47
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjmN:KIifqFu1//IifqFuyDA54GX79lSsCjmN
TLSH
T164F48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader

2026-08-04_bf046b6fe2980f03275448239a062a24_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 ce7b483b6cb98e5eeda17dee9b645fe14b410d350f1d3299c9fb360260dd25e5
MD5 bf046b6fe2980f03275448239a062a24
SHA1 bdd7b06807fd03fb4aba039f8016f3e57b1cdf27
SHA512 d8a632f8c45ead3c056f84fc0c7ac41d4092f7136e4afda9f0d5b10c358f35f8f0ad71aeaca1d56011af74800aa910c47bdcb10c7793cc787fc8b853352b6b47
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjmN:KIifqFu1//IifqFuyDA54GX79lSsCjmN
TLSH
T164F48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths