2026-08-04_973da223ed43b0bf6dc9057be92979f1_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-04_973da223ed43b0bf6dc9057be92979f1_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260804-xvmgnsyajd
SHA256 ef0917d57e24edfdb4e3118387989a12581ac16afe7be2a498dd39392178de17
MD5 973da223ed43b0bf6dc9057be92979f1
SHA1 74539e45e82625618b4d2865ab9c51fccfd0c8c0
SHA512 52433d2b0d9ef503f88b902ab867b71871a814cc80bb825ed09f3181681b05714a07d710fc5dd50c38c5c6728ed972020406a7ee3643f24efbbf873f142532d9
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCj29:KIifqFu1//IifqFuyDA54GX79lSsCj29
TLSH
T1B8F48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_973da223ed43b0bf6dc9057be92979f1_cobalt-strike_conti_elex_hijackloader

2026-08-04_973da223ed43b0bf6dc9057be92979f1_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 ef0917d57e24edfdb4e3118387989a12581ac16afe7be2a498dd39392178de17
MD5 973da223ed43b0bf6dc9057be92979f1
SHA1 74539e45e82625618b4d2865ab9c51fccfd0c8c0
SHA512 52433d2b0d9ef503f88b902ab867b71871a814cc80bb825ed09f3181681b05714a07d710fc5dd50c38c5c6728ed972020406a7ee3643f24efbbf873f142532d9
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCj29:KIifqFu1//IifqFuyDA54GX79lSsCj29
TLSH
T1B8F48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths