MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fdb54ba8049a094328ce44539afd239e0b78f7e0a75e4709aaf00f9d26ebb93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cosmu


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fdb54ba8049a094328ce44539afd239e0b78f7e0a75e4709aaf00f9d26ebb93
SHA3-384 hash: d44a1888cf20b3d1c7f0403a2e305a55bb7a94af92b649dce50c0f51a23cb043fb3fecf7fd17940fba0afa5a346c4d21
SHA1 hash: 6024e311c8bbb9a3c60d550a7caf2157c130c387
MD5 hash: 208eed6141b7c7e743bceeaa250b7370
humanhash: sink-illinois-fourteen-hamper
File name:virussign.com_208eed6141b7c7e743bceeaa250b7370
Download: download sample
Signature Cosmu
Create hunting rule
File size:337'022 bytes
First seen:2022-07-13 14:14:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8abecba2211e61763c4c9ffcaa13369e (172 x Cosmu, 1 x Zombie, 1 x CobaltStrike)
ssdeep 6144:MVwgzW+Dffz1gUZ3sOeNw0VqIJ/uJn9tvq3v3/sSQJw1Tk:MnW+Dfhg0cvd5JIDvTJw1o
Threatray 61 similar samples on MalwareBazaar
TLSH T110645B123BF4F476C60301328A59BBA4ACFABF595DE08C4327C40D6CEA758D6D265A1F
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter KdssSupport
Tags:Cosmu exe


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/287135/
Detection(s):
Win.Malware.Generickdz-9938530-0
Create hunting rule

Win.Trojan.Cosmu-1058
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Creating a file
Creating a process from a recently created file
Moving a recently created file
Searching for the window
Modifying an executable file
Sending a custom TCP request
Infecting executable files
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay rat shell32.dll
Link:
https://www.filescan.io/uploads/62ced3c43ec0b0689977020d/reports/42b5cd70-ad8d-447d-9f42-38f612928fd5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cosmu
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c5fc115f-b5a2-4521-aad7-386e63b77e4a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fdb54ba8049a094328ce44539afd239e0b78f7e0a75e4709aaf00f9d26ebb93/
Threat name:
Win32.Spyware.Zombie
Create hunting rule
Status:
Malicious
First seen:
2022-07-08 03:18:29 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 26 (96.15%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7nvjouajgqjimum4rcttl6shhqlpd36bj26i4e2v4aptutoxojq._file
Verdict:
malicious
Similar samples:
0a53a78b2728beb7f8fb17135bd7c013aca9d7a2ec73d8c81542d7dfcad8bead
Cosmu
3049c16e2b531f9fd1ab2a7e1ba95893e177714aaef0d956c2c19a9cfeee6d85
Cosmu
6757847f572bfe7d9d70d2dd8b18e2cd20794c6ee5af5c439d4d9d8778fe3d8a
Cosmu
7e26a05d10a275416faae5ab2721604bf485683e7ba2263627df7686e233da46
Cosmu
89555cf1e213cb3caa646805b6ccf1625f86028b0040cb4100df7845c136515e
Cosmu
8cfbd5a0ecf044d8ba89254e88d54479593a1666e0e2882edcfb4d505610d175
Cosmu
cecab83c0de9cb3ae4464198a4529d2a09807c50b7829c5f81d305a707dd9919
Cosmu
cf97aa9c205191e8beefb7162cddadb5065445fe8cf2931fda9ef6e29c64a3d2
Cosmu
ead6d9b750649261aa9b52ea8cf053d1b8178c1e6a21680361ea6763d39ecb9e
Cosmu
f4644d7df68f2c02da73638ef92352c969267890dab736ea48d60c063b1676b9
Cosmu
+ 51 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220713-rj5afsfacr/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8e5120b210168be259054dc187bbd80932a2c9c073aa7bed204a9643c7932ebe
MD5 hash:
f78f6a245fc700ad78ea43db9f9bd6df
SHA1 hash:
de103c36374c91e876a8d738878816a68ff35c5b
Link:
https://www.unpac.me/results/e5dcd311-0150-49be-b12d-89b1c407302d/
SH256 hash:
0fdb54ba8049a094328ce44539afd239e0b78f7e0a75e4709aaf00f9d26ebb93
MD5 hash:
208eed6141b7c7e743bceeaa250b7370
SHA1 hash:
6024e311c8bbb9a3c60d550a7caf2157c130c387
Link:
https://www.unpac.me/results/e5dcd311-0150-49be-b12d-89b1c407302d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0fdb54ba8049/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0fdb54ba8049a094328ce44539afd239e0b78f7e0a75e4709aaf00f9d26ebb93

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Cosmu

Executable exe 0fdb54ba8049a094328ce44539afd239e0b78f7e0a75e4709aaf00f9d26ebb93

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/287135/

Comments