General
- Target 2026-10-22_425e28566a6e02693a5f98d172afc35b_amadey_coinminer_elex_wannacry
- Size 2.5MB
- Sample261024-slxh3act7m
- SHA256 ee08522f9770a83cdc399afdb2e8a599cc828b35405f9e7315a2595c8e64aed4
Score
10/10
Malware Config
Targets
-
- Target 2026-10-22_425e28566a6e02693a5f98d172afc35b_amadey_coinminer_elex_wannacry
- Size 2.5MB
- SHA256 ee08522f9770a83cdc399afdb2e8a599cc828b35405f9e7315a2595c8e64aed4
Score10/10Detects Cosmu payload
Cosmu is a worm written in C++.
Family: Cosmu
Cosmu is a Windows worm written in C++.
Renames multiple (1686) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Custom signature
UPX dump on OEP (original entry point)
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Drops file in System32 directory
Suspicious use of SetThreadContext
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.