cosmu | 707be077275a1328700fdc8813fc4cf2d73730257e26c80e97645dfd5a01870a

General

Target
2026-08-25_90e120b6ab411acfb2929f21487572fe_coinminer_elex_wannacry
Size 515KB
Sample260826-v16fmatbma
SHA256 707be077275a1328700fdc8813fc4cf2d73730257e26c80e97645dfd5a01870a
MD5 90e120b6ab411acfb2929f21487572fe
SHA1 e05adc724c36829d93a030409999d2e0fb28c798
SHA512 e03c0ac90af2c2db8ccd9eaea161fb300c7e94af783e48bc6925e48f14d0b156e398db7709b0642d195d46c7e148365a64232be830e70da31fd21f5bc7d36a32
SSDEEP 12288:DS4nzSOoQVMAvGGEa1Ewxe9Q5alMf1vAvS:5SOoH/GEoEbQ5zNvA6
TLSH
T14AB44A0639FCC737E3D25530CE6EBA90B0F5B9684F2148A73AD43D1C2A76991D316A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-25_90e120b6ab411acfb2929f21487572fe_coinminer_elex_wannacry
- Size 515KB
- SHA256 707be077275a1328700fdc8813fc4cf2d73730257e26c80e97645dfd5a01870a
- MD5 90e120b6ab411acfb2929f21487572fe
- SHA1 e05adc724c36829d93a030409999d2e0fb28c798
- SHA512 e03c0ac90af2c2db8ccd9eaea161fb300c7e94af783e48bc6925e48f14d0b156e398db7709b0642d195d46c7e148365a64232be830e70da31fd21f5bc7d36a32
- SSDEEP 12288:DS4nzSOoQVMAvGGEa1Ewxe9Q5alMf1vAvS:5SOoH/GEoEbQ5zNvA6
- TLSH
  T14AB44A0639FCC737E3D25530CE6EBA90B0F5B9684F2148A73AD43D1C2A76991D316A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery cosmu ransomware upx worm
- Detects Cosmu payload
  Cosmu is a worm written in C++.
- Family: Cosmu
  Cosmu is a Windows worm written in C++.
  worm cosmu
- Renames multiple (5137) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Cosmu payload

Family: Cosmu

Renames multiple (5137) files with added filename extension

UPX dump on OEP (original entry point)

Executes dropped EXE

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2