2026-08-04_229e43545372bb061fa4e604aee2f282_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-04_229e43545372bb061fa4e604aee2f282_cobalt-strike_conti_elex_hijackloader
Size 765KB
Sample260804-zrec1agg95
SHA256 5b78c7a511d995e2bbbada1109a29d409164ac72e547eb7cc468173f978d2299
MD5 229e43545372bb061fa4e604aee2f282
SHA1 6002e45d4b921cd4431649985663175781d828d0
SHA512 2e1985cacafd8554bd52ef6a735327df7c81b16cb24d2c0b711abd91167bd761704b79ac9e7537968309ff29fd9e72a9ac8f957c3f859b818eed8440b7be8f55
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjQ0a:KIifqFu1//IifqFuyDA54GX79lSsCjQN
TLSH
T1D2F48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Custom signature

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_229e43545372bb061fa4e604aee2f282_cobalt-strike_conti_elex_hijackloader

2026-08-04_229e43545372bb061fa4e604aee2f282_cobalt-strike_conti_elex_hijackloader

.exe 765KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 5b78c7a511d995e2bbbada1109a29d409164ac72e547eb7cc468173f978d2299
MD5 229e43545372bb061fa4e604aee2f282
SHA1 6002e45d4b921cd4431649985663175781d828d0
SHA512 2e1985cacafd8554bd52ef6a735327df7c81b16cb24d2c0b711abd91167bd761704b79ac9e7537968309ff29fd9e72a9ac8f957c3f859b818eed8440b7be8f55
SSDEEP 12288:cP5V5KV5izrqFkbGE/F5V5KV5izrqFkbQX6IjUl54G2nC79lSsCjQ0a:KIifqFu1//IifqFuyDA54GX79lSsCjQN
TLSH
T1D2F48E07F6A244FCD517C17089E69372EA71FC225620AB7F2758E6212F60F906F3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths