cosmu | 791fd47cf61e824f68b2230bdf3e00c5f28833e54816fd06f310e7420ccaf3f0

General

Target
2026-08-14_53d1d1baab2e78425493dbf8fe19c273_coinminer_elex_wannacry
Size 546KB
Sample260814-jtxdlayaqa
SHA256 791fd47cf61e824f68b2230bdf3e00c5f28833e54816fd06f310e7420ccaf3f0
MD5 53d1d1baab2e78425493dbf8fe19c273
SHA1 3c7b8d731ca9b422d0642f31a5161cac61cebe27
SHA512 0f83792b6f55b103f4782ecbb6ff8150613cb1bd99926c9292316b7b9ccb7343a0abe25c2cac9d32e7b34c4013c5f606bc1b19042ddbbc59e4df756471c7c365
SSDEEP 6144:K7Cn1fxSXJ56oQ4OZMAfquGG3UaBXz4wFVU4eOmdhxzCT5jmlMUXAl1vxRMXfk5b:/nzSOoQVMAvGGEa1Ewxe9Q5alMf1vAvO
TLSH
T158C4280A39FCC637E3D14531CE5EBA90B0F5B9682F218DA336D43D1C2A76991A31661F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-14_53d1d1baab2e78425493dbf8fe19c273_coinminer_elex_wannacry
- Size 546KB
- SHA256 791fd47cf61e824f68b2230bdf3e00c5f28833e54816fd06f310e7420ccaf3f0
- MD5 53d1d1baab2e78425493dbf8fe19c273
- SHA1 3c7b8d731ca9b422d0642f31a5161cac61cebe27
- SHA512 0f83792b6f55b103f4782ecbb6ff8150613cb1bd99926c9292316b7b9ccb7343a0abe25c2cac9d32e7b34c4013c5f606bc1b19042ddbbc59e4df756471c7c365
- SSDEEP 6144:K7Cn1fxSXJ56oQ4OZMAfquGG3UaBXz4wFVU4eOmdhxzCT5jmlMUXAl1vxRMXfk5b:/nzSOoQVMAvGGEa1Ewxe9Q5alMf1vAvO
- TLSH
  T158C4280A39FCC637E3D14531CE5EBA90B0F5B9682F218DA336D43D1C2A76991A31661F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery cosmu ransomware upx worm
- Detects Cosmu payload
  Cosmu is a worm written in C++.
- Family: Cosmu
  Cosmu is a Windows worm written in C++.
  worm cosmu
- Renames multiple (4904) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Cosmu payload

Family: Cosmu

Renames multiple (4904) files with added filename extension

UPX dump on OEP (original entry point)

Executes dropped EXE

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2