2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar

General

Target
2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar
Size 809KB
Sample260827-d4yfrayhnd
SHA256 65ab88d7c54e9927e36e1380f96423c7f2550b71513da6284dfe0bdc72223dad
MD5 ef342d7086de0cc83f4eeeff54f4e13f
SHA1 fe8cb5719fea59ab8d93501b4ba94793e75b775a
SHA512 086e76fc3edd26773a9c63609afa385909526b03cca796f8bd754a0a7c0765c69d17a1350503785e75e2fd7ae4d33121918017372eb7115500309ca49529f1b4
SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar0:cPE/72wcCvRR5FTjkWIw2wEHsxqp
TLSH
T1DC05081767EC0994E5B2663049B54611EA72F8561B31C6CF11A88B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar

2026-08-26_ef342d7086de0cc83f4eeeff54f4e13f_cobalt-strike_conti_elex_hijackloader_vidar

.exe 809KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 65ab88d7c54e9927e36e1380f96423c7f2550b71513da6284dfe0bdc72223dad
MD5 ef342d7086de0cc83f4eeeff54f4e13f
SHA1 fe8cb5719fea59ab8d93501b4ba94793e75b775a
SHA512 086e76fc3edd26773a9c63609afa385909526b03cca796f8bd754a0a7c0765c69d17a1350503785e75e2fd7ae4d33121918017372eb7115500309ca49529f1b4
SSDEEP 6144:cVHJZ+au/72wopCfTXkxqD6EbR7OjwYF+J5nyf0VPUgjnRtnNlW4+WD8TbVC2ar0:cPE/72wcCvRR5FTjkWIw2wEHsxqp
TLSH
T1DC05081767EC0994E5B2663049B54611EA72F8561B31C6CF11A88B3D1E73BF0BD38B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths