cosmu | 2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader

General

Target
2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader
Size 296KB
Sample260826-cgzvmabd79
SHA256 9b36a95a3ca4bbe3fdc4350dffd6510669472d348f6533f41248fc1586d9227d
MD5 f4903cf5026d228aa48b66c12e530bfa
SHA1 036e8192a7254a068d8a7fcdea266caaf0de1af2
SHA512 81bf083ea2d98cd09f57d5db59c649c13ed773e148c5c43285a7cafbbe5dc16cd409060fb2c4e75bdcef6bdc2da60b7e785ce08e9da0c2013e6f6be2340dcac9
SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTVwloAXjiU4bz:BfBQGH6Sf+loAX+U4
TLSH
T13C54E0403A9ECBB2D3C249318C6EFAE1477A7C2FAB559137F7983B0F1E712845666241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm cosmu

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 1 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
sample	family_cosmu

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader

File Explorer

2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader

.exe 296KB

2026-08-25_f4903cf5026d228aa48b66c12e530bfa_elex_rhadamanthys_smoke-loader

IMPHASH 5aa33c577ffd8431ff254de85dee5e7b
SHA256 9b36a95a3ca4bbe3fdc4350dffd6510669472d348f6533f41248fc1586d9227d
MD5 f4903cf5026d228aa48b66c12e530bfa
SHA1 036e8192a7254a068d8a7fcdea266caaf0de1af2
SHA512 81bf083ea2d98cd09f57d5db59c649c13ed773e148c5c43285a7cafbbe5dc16cd409060fb2c4e75bdcef6bdc2da60b7e785ce08e9da0c2013e6f6be2340dcac9
SSDEEP 6144:mFlKgzelZNQSBQGH/CSpWqTVwloAXjiU4bz:BfBQGH6Sf+loAX+U4
TLSH
T13C54E0403A9ECBB2D3C249318C6EFAE1477A7C2FAB559137F7983B0F1E712845666241
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Cosmu payload

Cosmu is a worm written in C++.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\workplace\c++\hannibal\release\hannibal.pdb

kernel32

CreateFileA GetFileSize FindResourceA SetFilePointer FreeLibrary LoadResource UpdateResourceA SetFileTime WriteFile GetDriveTypeA SizeofResource GetFileAttributesA ReadFile MultiByteToWideChar FindFirstFileA GetLastError CopyFileA SetFileAttributesA FindClose LockResource BeginUpdateResourceA GetModuleFileNameA FindNextFileA LoadLibraryExA EnumResourceNamesA GetFileTime EndUpdateResourceA WinExec CloseHandle DeleteFileA CompareStringW CompareStringA FlushFileBuffers GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP Sleep WideCharToMultiByte GetTimeZoneInformation RaiseException ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSection RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA

ole32

CoUninitialize CoCreateInstance CoInitialize

Sharing