2026-08-04_5685009f8f62e7dc052d7e1120728435_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-04_5685009f8f62e7dc052d7e1120728435_cobalt-strike_conti_elex_hijackloader
Size 742KB
Sample260804-yyplwagc76
SHA256 7c4fc6ddc79da8979b5c96e917fecb9938ceeedddafaaec56e4bd98aac244cc7
MD5 5685009f8f62e7dc052d7e1120728435
SHA1 09780a125ab201325ca5813c51cfe6c0d22abd02
SHA512 ba72d2259461d70ce1f253de5a26084ecbe655db2491d5c9094aa7539ee50531368680dfb3f29be90341add8b60e65e4b47efa5e77b57d554f7b7961325720e0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSj2j9:KIifqFu1//IifqFuyDA54GX79lSj2j9
TLSH
T156F48D07F6A244FCC557C17089E69372EA71FC225620AB7F2768E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_5685009f8f62e7dc052d7e1120728435_cobalt-strike_conti_elex_hijackloader

2026-08-04_5685009f8f62e7dc052d7e1120728435_cobalt-strike_conti_elex_hijackloader

.exe 742KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 7c4fc6ddc79da8979b5c96e917fecb9938ceeedddafaaec56e4bd98aac244cc7
MD5 5685009f8f62e7dc052d7e1120728435
SHA1 09780a125ab201325ca5813c51cfe6c0d22abd02
SHA512 ba72d2259461d70ce1f253de5a26084ecbe655db2491d5c9094aa7539ee50531368680dfb3f29be90341add8b60e65e4b47efa5e77b57d554f7b7961325720e0
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSj2j9:KIifqFu1//IifqFuyDA54GX79lSj2j9
TLSH
T156F48D07F6A244FCC557C17089E69372EA71FC225620AB7F2768E6212F60F906F3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths