cosmu | 273b53e078db6ad86c93713d61964b99a78cf11109d6204c8b07d4bdfd716d0b

General

Target
2026-08-25_e7b576a35e012d0250c05fc410a4a520_coinminer_elex_wannacry
Size 551KB
Sample260826-e2d5rsyxa1
SHA256 273b53e078db6ad86c93713d61964b99a78cf11109d6204c8b07d4bdfd716d0b
MD5 e7b576a35e012d0250c05fc410a4a520
SHA1 983d57dd6e2f47904d77edc4d3adbf049119230e
SHA512 0e79cfb778f6517759389d79906a3fd7a37e35220362a022dda25af985ec2dfeee8c8092dee6585ffa0eef34a5abe259ba8b9555fb925ca9c005a643d3506dfb
SSDEEP 12288:y2ErnzSOoQVMAvGGEa1Ewxe9Q5alMf1vAvB:y2E/SOoH/GEoEbQ5zNvAJ
TLSH
T16FC44A0A3AFCC737E3D25530CE6FBA90B0F5B9684F2148973AD41E1C2A76992D31661D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-25_e7b576a35e012d0250c05fc410a4a520_coinminer_elex_wannacry
- Size 551KB
- SHA256 273b53e078db6ad86c93713d61964b99a78cf11109d6204c8b07d4bdfd716d0b
- MD5 e7b576a35e012d0250c05fc410a4a520
- SHA1 983d57dd6e2f47904d77edc4d3adbf049119230e
- SHA512 0e79cfb778f6517759389d79906a3fd7a37e35220362a022dda25af985ec2dfeee8c8092dee6585ffa0eef34a5abe259ba8b9555fb925ca9c005a643d3506dfb
- SSDEEP 12288:y2ErnzSOoQVMAvGGEa1Ewxe9Q5alMf1vAvB:y2E/SOoH/GEoEbQ5zNvAJ
- TLSH
  T16FC44A0A3AFCC737E3D25530CE6FBA90B0F5B9684F2148973AD41E1C2A76992D31661D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery cosmu ransomware upx worm
- Detects Cosmu payload
  Cosmu is a worm written in C++.
- Family: Cosmu
  Cosmu is a Windows worm written in C++.
  worm cosmu
- Renames multiple (5124) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Cosmu payload

Family: Cosmu

Renames multiple (5124) files with added filename extension

UPX dump on OEP (original entry point)

Executes dropped EXE

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2