2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar

General

Target
2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar
Size 886KB
Sample260804-xbxtasxfla
SHA256 dfbab9519f5ee66a9ed155e8818faa12b269dc69cb2c17d234fd2baa6eff5267
MD5 b3428732c7ef28b9c3b45054af04c70d
SHA1 c16e8e291fa83d9aa91e15e6b8b4d90d7761de5f
SHA512 124205c13cf6bb594d3d434714c26165c02b7b13ba7b3cc8e93c469af530fdbdeec870aafd9ff3e9810c9113a7bb80c3346867c71d93e27c0475cfecd9676524
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjHXsf3z:KIifqFu1//IifqFuyDA54GX79lSsCjuD
TLSH
T186154C06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar

2026-08-04_b3428732c7ef28b9c3b45054af04c70d_cobalt-strike_conti_elex_hijackloader_vidar

.exe 886KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 dfbab9519f5ee66a9ed155e8818faa12b269dc69cb2c17d234fd2baa6eff5267
MD5 b3428732c7ef28b9c3b45054af04c70d
SHA1 c16e8e291fa83d9aa91e15e6b8b4d90d7761de5f
SHA512 124205c13cf6bb594d3d434714c26165c02b7b13ba7b3cc8e93c469af530fdbdeec870aafd9ff3e9810c9113a7bb80c3346867c71d93e27c0475cfecd9676524
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjHXsf3z:KIifqFu1//IifqFuyDA54GX79lSsCjuD
TLSH
T186154C06E29204ACC55F8130C7A65371BA73BC2156E0A7AF13D4F63D2F31B906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths