cosmu | 2026-07-22_38bf830508333715fce001efcaa236d9_cobalt-strike_elex_icedid_njrat_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_38bf830508333715fce001efcaa236d9_cobalt-strike_elex_icedid_njrat_rhadamanthys
Size 732KB
Sample260723-aevf1sxdrc
SHA256 401b6ec7b6ed120a47668a4ff880e83778281d6833b91e330db4fc9db4137a0b
MD5 38bf830508333715fce001efcaa236d9
SHA1 244b5cbe1a160597cbc2d311bf7a05fc8fe025ac
SHA512 b1473bc48f1df5d10a845161172cf8f5ecc8a93eda7f81a0912383aa520dd6f181a24841e8458c467f3d207aaea42832e359f0dc0b3eb73a70197e01be0f858a
SSDEEP 12288:uUfBQGH6Sf1Qher5+nZoygL0fmer5+nIwaJS:Xfa86Sf219Hu
TLSH
T14EF46C0BF75298E2C9594A355E644291673AE453AEC74353B98C030DCF6738ABF26F38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm cosmu

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 1 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
sample	family_cosmu

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_38bf830508333715fce001efcaa236d9_cobalt-strike_elex_icedid_njrat_rhadamanthys

File Explorer

2026-07-22_38bf830508333715fce001efcaa236d9_cobalt-strike_elex_icedid_njrat_rhadamanthys

.exe 732KB

2026-07-22_38bf830508333715fce001efcaa236d9_cobalt-strike_elex_icedid_njrat_rhadamanthys

IMPHASH 5aa33c577ffd8431ff254de85dee5e7b
SHA256 401b6ec7b6ed120a47668a4ff880e83778281d6833b91e330db4fc9db4137a0b
MD5 38bf830508333715fce001efcaa236d9
SHA1 244b5cbe1a160597cbc2d311bf7a05fc8fe025ac
SHA512 b1473bc48f1df5d10a845161172cf8f5ecc8a93eda7f81a0912383aa520dd6f181a24841e8458c467f3d207aaea42832e359f0dc0b3eb73a70197e01be0f858a
SSDEEP 12288:uUfBQGH6Sf1Qher5+nZoygL0fmer5+nIwaJS:Xfa86Sf219Hu
TLSH
T14EF46C0BF75298E2C9594A355E644291673AE453AEC74353B98C030DCF6738ABF26F38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Cosmu payload

Cosmu is a worm written in C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\workplace\c++\hannibal\release\hannibal.pdb

kernel32

CreateFileA GetFileSize FindResourceA SetFilePointer FreeLibrary LoadResource UpdateResourceA SetFileTime WriteFile GetDriveTypeA SizeofResource GetFileAttributesA ReadFile MultiByteToWideChar FindFirstFileA GetLastError CopyFileA SetFileAttributesA FindClose LockResource BeginUpdateResourceA GetModuleFileNameA FindNextFileA LoadLibraryExA EnumResourceNamesA GetFileTime EndUpdateResourceA WinExec CloseHandle DeleteFileA CompareStringW CompareStringA FlushFileBuffers GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP Sleep WideCharToMultiByte GetTimeZoneInformation RaiseException ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSection RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA

ole32

CoUninitialize CoCreateInstance CoInitialize

Name

.text

Size

52KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

140KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

924B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.l2

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

FfmzvKwZ

Size

136KB

Virtual Size

133KB

Characteristics

Name

gbxKHLkj

Size

4KB

Virtual Size

3KB

Characteristics

Name

LZtaSpVY

Size

4KB

Virtual Size

2KB

Characteristics

Name

mUDWZmCE

Size

32KB

Virtual Size

31KB

Characteristics

Name

ZojZjeFA

Size

124KB

Virtual Size

120KB

Characteristics

Name

ymcGjHvD

Size

128KB

Virtual Size

124KB

Characteristics

Name

cuctBnBU

Size

4KB

Virtual Size

1KB

Characteristics

Name

ZAkqdvaf

Size

36KB

Virtual Size

33KB

Characteristics

Name

ezHefavx

Size

4KB

Virtual Size

538B

Characteristics

Name

toOxdIUR

Size

24KB

Virtual Size

23KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_38bf830508333715fce001efcaa236d9_cobalt-strike_elex_icedid_njrat_rhadamanthys

kernel32

ole32

generic