CosascoDataSetup[.]exe

Resubmissions

05/08/2026, 12:43

260805-px4vqsste17

05/08/2026, 12:20

260805-php32axcrg7

Sharing

Copy URL Twitter E-mail

General

Target
CosascoDataSetup.exe
Size 202.9MB
Sample260805-php32axcrg
SHA256 724e7dab05e9a0ca094d4ee7eb3f295db35723b0260035c964b68c3bd667bfc0
MD5 ac56573a2c4533315a961ce345e6fb72
SHA1 1c71fcbf2118191353ab8517af96d5f247e4e4ef
SHA512 2857de85019e18b3b4dd912658abe76230736d592017826ca4e291eea276f66a4c4aa8ebf2ebae5bf877ea1ed9be78ffd0b6b6ef13a37924653bb4688a58c3bb
SSDEEP 6291456:d83ivvq/InOsHbTppTlz03sqgH/0YEfQssQ9q8ugpf:Cya/QZpTlwcqgH/0XfQc9q+f
TLSH
T1E3A83373446A8B7DDBE11C355820F62A8E1CB2385AC58D34E7BBD8F647621C363B3865
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CosascoDataSetup.exe

File Explorer

CosascoDataSetup.exe

.exe 202.9MB

CosascoDataSetup.exe

IMPHASH 42d651751c1d75ed4fa8fe71751854ff
SHA256 724e7dab05e9a0ca094d4ee7eb3f295db35723b0260035c964b68c3bd667bfc0
MD5 ac56573a2c4533315a961ce345e6fb72
SHA1 1c71fcbf2118191353ab8517af96d5f247e4e4ef
SHA512 2857de85019e18b3b4dd912658abe76230736d592017826ca4e291eea276f66a4c4aa8ebf2ebae5bf877ea1ed9be78ffd0b6b6ef13a37924653bb4688a58c3bb
SSDEEP 6291456:d83ivvq/InOsHbTppTlz03sqgH/0YEfQssQ9q8ugpf:Cya/QZpTlwcqgH/0XfQc9q+f
TLSH
T1E3A83373446A8B7DDBE11C355820F62A8E1CB2385AC58D34E7BBD8F647621C363B3865
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188273

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\agent\_work\66\s\build\ship\x86\burn.pdb

advapi32

RegCloseKey RegOpenKeyExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW RegQueryValueExW RegDeleteValueW CloseEventLog OpenEventLogW ReportEventW ConvertStringSecurityDescriptorToSecurityDescriptorW DecryptFileW CreateWellKnownSid InitializeAcl SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceConfigW

user32

PeekMessageW PostMessageW IsWindow WaitForInputIdle PostQuitMessage GetMessageW TranslateMessage MsgWaitForMultipleObjects PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW LoadCursorW LoadBitmapW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW DispatchMessageW

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

gdi32

DeleteDC DeleteObject SelectObject StretchBlt GetObjectW CreateCompatibleDC

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CLSIDFromProgID CoInitializeSecurity

kernel32

GetCPInfo GetOEMCP IsValidCodePage CloseHandle CreateFileW GetProcAddress LocalFree HeapSetInformation GetLastError GetModuleHandleW FormatMessageW lstrlenA lstrlenW MultiByteToWideChar WideCharToMultiByte LCMapStringW Sleep GetLocalTime GetModuleFileNameW ExpandEnvironmentStringsW GetTempPathW GetTempFileNameW CreateDirectoryW GetFullPathNameW CompareStringW GetCurrentProcessId WriteFile SetFilePointer LoadLibraryW GetSystemDirectoryW CreateFileA HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindClose GetCommandLineA GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW MoveFileExW GetCurrentProcess GetCurrentThreadId InitializeCriticalSection DeleteCriticalSection ReleaseMutex TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessW GetVersionExW VerSetConditionMask FreeLibrary EnterCriticalSection LeaveCriticalSection GetSystemTime GetNativeSystemInfo GetModuleHandleExW GetWindowsDirectoryW GetSystemWow64DirectoryW GetCommandLineW VerifyVersionInfoW GetVolumePathNameW GetDateFormatW GetUserDefaultUILanguage GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW ReadFile SetFilePointerEx DuplicateHandle InterlockedExchange InterlockedCompareExchange LoadLibraryExW CreateEventW ProcessIdToSessionId OpenProcess GetProcessId WaitForSingleObject ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread SetEvent WaitForMultipleObjects InterlockedIncrement InterlockedDecrement ResetEvent SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CompareStringA GetExitCodeProcess SetThreadExecutionState CopyFileExW MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW GetThreadLocale FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers DecodePointer WriteConsoleW GetModuleHandleA GlobalAlloc GlobalFree GetFileSizeEx CopyFileW VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime GetTimeZoneInformation SystemTimeToFileTime GetSystemInfo VirtualProtect VirtualQuery GetComputerNameW SetCurrentDirectoryW GetFileType GetACP ExitProcess GetStdHandle InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException LoadLibraryExA

rpcrt4

UuidCreate