General
- Target a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7
- Size 201KB
- Sample260830-2ht37saq9x
- SHA256 a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7
Score
10/10
Malware Config
Targets
-
- Target a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7
- Size 201KB
- SHA256 a4f43a6f802512ca01c0900c79bee3990d0dec4575617999c4b8eb9449d00bf7
Score10/10-
Detects Cosmu payload
Cosmu is a worm written in C++.
-
Family: Cosmu
Cosmu is a Windows worm written in C++.
-
Renames multiple (1325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Drops file in System32 directory