2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260804-vw2a4sec43
SHA256 6d870cc2cffc4cac93162fec93310abcc3005a8ca9e52b24320086c1e6aefe2f
MD5 feb16cd25824587a5e2762d9728ba480
SHA1 ee6baa5a22fb6337e19e4ff8d2062f74fbb2a809
SHA512 35aa3550cb681aa1d1709abe9296b5173b968efa03c902b91c3d35c475dc6208545732f8a347047811cff6c181f9e341dd773b404f4225c2a3aec187fad7a4a4
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGl9:KIifqFu1//IifqFuyDA54GX79lSzQGl9
TLSH
T1C8F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader

2026-08-04_feb16cd25824587a5e2762d9728ba480_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 6d870cc2cffc4cac93162fec93310abcc3005a8ca9e52b24320086c1e6aefe2f
MD5 feb16cd25824587a5e2762d9728ba480
SHA1 ee6baa5a22fb6337e19e4ff8d2062f74fbb2a809
SHA512 35aa3550cb681aa1d1709abe9296b5173b968efa03c902b91c3d35c475dc6208545732f8a347047811cff6c181f9e341dd773b404f4225c2a3aec187fad7a4a4
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSzQGl9:KIifqFu1//IifqFuyDA54GX79lSzQGl9
TLSH
T1C8F48E07F6E244FCD517C17089E69372EA71FC225620AB7F2768E6212F60F906F2A754
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths