cosmu | 2026-08-16_c476075f1c2d11d14b2f722bdae67439_cobalt-strike_elex_icedid_njrat_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_c476075f1c2d11d14b2f722bdae67439_cobalt-strike_elex_icedid_njrat_rhadamanthys
Size 828KB
Sample260816-cassqsxdrd
SHA256 36a4943d1b8ad9e88420e63c20772b473a23bd5a023894f1c0fc600843372a7f
MD5 c476075f1c2d11d14b2f722bdae67439
SHA1 2aa7934ab9a995050a449db0c4ca10fe645d63a3
SHA512 6daaf466d11698df21fed10da0980f86789a9f9bc7e69b6bd6c3eb6adb79f05a299edb4c10d969cd5477d5fa5f83c21f8154d11e5a18c2c7e10f59b2129ae426
SSDEEP 12288:DUfBQGH6SfCQ7L1VAqmer5+nIwaJVer5+njer5+nsoZV:gfa86Sf3bA6G2
TLSH
T1FA055A03FB914AE6C69949759E640280673AE4126ECB5712B94C130DCF6778BBF26F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm cosmu

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 1 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
sample	family_cosmu

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_c476075f1c2d11d14b2f722bdae67439_cobalt-strike_elex_icedid_njrat_rhadamanthys

File Explorer

2026-08-16_c476075f1c2d11d14b2f722bdae67439_cobalt-strike_elex_icedid_njrat_rhadamanthys

.exe 828KB

2026-08-16_c476075f1c2d11d14b2f722bdae67439_cobalt-strike_elex_icedid_njrat_rhadamanthys

IMPHASH 5aa33c577ffd8431ff254de85dee5e7b
SHA256 36a4943d1b8ad9e88420e63c20772b473a23bd5a023894f1c0fc600843372a7f
MD5 c476075f1c2d11d14b2f722bdae67439
SHA1 2aa7934ab9a995050a449db0c4ca10fe645d63a3
SHA512 6daaf466d11698df21fed10da0980f86789a9f9bc7e69b6bd6c3eb6adb79f05a299edb4c10d969cd5477d5fa5f83c21f8154d11e5a18c2c7e10f59b2129ae426
SSDEEP 12288:DUfBQGH6SfCQ7L1VAqmer5+nIwaJVer5+njer5+nsoZV:gfa86Sf3bA6G2
TLSH
T1FA055A03FB914AE6C69949759E640280673AE4126ECB5712B94C130DCF6778BBF26F3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Cosmu payload

Cosmu is a worm written in C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\workplace\c++\hannibal\release\hannibal.pdb

kernel32

CreateFileA GetFileSize FindResourceA SetFilePointer FreeLibrary LoadResource UpdateResourceA SetFileTime WriteFile GetDriveTypeA SizeofResource GetFileAttributesA ReadFile MultiByteToWideChar FindFirstFileA GetLastError CopyFileA SetFileAttributesA FindClose LockResource BeginUpdateResourceA GetModuleFileNameA FindNextFileA LoadLibraryExA EnumResourceNamesA GetFileTime EndUpdateResourceA WinExec CloseHandle DeleteFileA CompareStringW CompareStringA FlushFileBuffers GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP Sleep WideCharToMultiByte GetTimeZoneInformation RaiseException ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSection RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA

ole32

CoUninitialize CoCreateInstance CoInitialize

Name

.text

Size

52KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

140KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

936B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.l2

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

pGipkmIX

Size

4KB

Virtual Size

3KB

Characteristics

Name

xcGbUlWu

Size

4KB

Virtual Size

2KB

Characteristics

Name

ozzMZeLN

Size

4KB

Virtual Size

2KB

Characteristics

Name

fSkWMbCH

Size

40KB

Virtual Size

38KB

Characteristics

Name

tXIziDzt

Size

220KB

Virtual Size

219KB

Characteristics

Name

HDaNNvTW

Size

96KB

Virtual Size

94KB

Characteristics

Name

XxyJJmoH

Size

4KB

Virtual Size

3KB

Characteristics

Name

kuKelQep

Size

68KB

Virtual Size

67KB

Characteristics

Name

hinjQGkN

Size

4KB

Virtual Size

3KB

Characteristics

Name

igwruYNT

Size

148KB

Virtual Size

145KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_c476075f1c2d11d14b2f722bdae67439_cobalt-strike_elex_icedid_njrat_rhadamanthys

kernel32

ole32

generic