2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader

General

Target
2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader
Size 973KB
Sample260810-thfxkssdrb
SHA256 597f0e59cee1b74ab712f8f167e8de86ab38be351337a57002b5c66c41a990d2
MD5 e7939c7e7c67ed529fa5a24414534d58
SHA1 41b9200d34cc0b502b3d8de708cee5cd7013de08
SHA512 3189a7e242b2b7b1766cd506efd1b5829a085e80a4784a829f323c95aa61a5365820f88064507be3e1fd0bf1371a3c4fe6f9323b8fa86397736bdb32e7bf5603
SSDEEP 12288:cPE/F5V5KV5izrqFkbQX6IjUl54G2nC79Q1gL5pRTcAkS/3hzN8qE43fm78VIcF:J//IifqFuyDA54GX79l5jcAkSYqyEIcF
TLSH
T16F255A16F6608679D073C0B5C5D2A7B6EE31384547309BDF1389D7282F23BE69A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader

2026-08-10_e7939c7e7c67ed529fa5a24414534d58_amadey_cobalt-strike_conti_elex_hijackloader

.exe 973KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 597f0e59cee1b74ab712f8f167e8de86ab38be351337a57002b5c66c41a990d2
MD5 e7939c7e7c67ed529fa5a24414534d58
SHA1 41b9200d34cc0b502b3d8de708cee5cd7013de08
SHA512 3189a7e242b2b7b1766cd506efd1b5829a085e80a4784a829f323c95aa61a5365820f88064507be3e1fd0bf1371a3c4fe6f9323b8fa86397736bdb32e7bf5603
SSDEEP 12288:cPE/F5V5KV5izrqFkbQX6IjUl54G2nC79Q1gL5pRTcAkS/3hzN8qE43fm78VIcF:J//IifqFuyDA54GX79l5jcAkSYqyEIcF
TLSH
T16F255A16F6608679D073C0B5C5D2A7B6EE31384547309BDF1389D7282F23BE69A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths