cosmu | 5729b374755df5eb3a0fd052d77089f564c3a4969ac122537a9d6fc573a6f24a

General

Target
5729b374755df5eb3a0fd052d77089f564c3a4969ac122537a9d6fc573a6f24a
Size 264KB
Sample260825-wca59atthx
SHA256 5729b374755df5eb3a0fd052d77089f564c3a4969ac122537a9d6fc573a6f24a
MD5 9756e8bc040c6fc58559c06b0024a389
SHA1 d4cdce365b89219a747e361a47242dd9a426c172
SHA512 563b530156fd5067a759ebcc47b8c01e1fdc9ef7416edaa22fcdf82b4b8532b7c92956232fc9ca33cecd3dbde0192157829a3ec9aa4a08b03c0824f6610cfb8d
SSDEEP 3072:6QXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB2:/9lKgzelZNQSBQGH/CSpWqT
TLSH
T1C244F1513C93C4B3D44189328DA6CBE5977B7D03AEA1E107FBD83F4F5E712888AA6251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm cosmu

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 1 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
sample	family_cosmu

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5729b374755df5eb3a0fd052d77089f564c3a4969ac122537a9d6fc573a6f24a

File Explorer

5729b374755df5eb3a0fd052d77089f564c3a4969ac122537a9d6fc573a6f24a

.exe 264KB

5729b374755df5eb3a0fd052d77089f564c3a4969ac122537a9d6fc573a6f24a

IMPHASH 5aa33c577ffd8431ff254de85dee5e7b
SHA256 5729b374755df5eb3a0fd052d77089f564c3a4969ac122537a9d6fc573a6f24a
MD5 9756e8bc040c6fc58559c06b0024a389
SHA1 d4cdce365b89219a747e361a47242dd9a426c172
SHA512 563b530156fd5067a759ebcc47b8c01e1fdc9ef7416edaa22fcdf82b4b8532b7c92956232fc9ca33cecd3dbde0192157829a3ec9aa4a08b03c0824f6610cfb8d
SSDEEP 3072:6QXi3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB2:/9lKgzelZNQSBQGH/CSpWqT
TLSH
T1C244F1513C93C4B3D44189328DA6CBE5977B7D03AEA1E107FBD83F4F5E712888AA6251
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Cosmu payload

Cosmu is a worm written in C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\workplace\c++\hannibal\release\hannibal.pdb

kernel32

CreateFileA GetFileSize FindResourceA SetFilePointer FreeLibrary LoadResource UpdateResourceA SetFileTime WriteFile GetDriveTypeA SizeofResource GetFileAttributesA ReadFile MultiByteToWideChar FindFirstFileA GetLastError CopyFileA SetFileAttributesA FindClose LockResource BeginUpdateResourceA GetModuleFileNameA FindNextFileA LoadLibraryExA EnumResourceNamesA GetFileTime EndUpdateResourceA WinExec CloseHandle DeleteFileA CompareStringW CompareStringA FlushFileBuffers GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP Sleep WideCharToMultiByte GetTimeZoneInformation RaiseException ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSection RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA

ole32

CoUninitialize CoCreateInstance CoInitialize

Sharing