MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cecab83c0de9cb3ae4464198a4529d2a09807c50b7829c5f81d305a707dd9919. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cosmu


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cecab83c0de9cb3ae4464198a4529d2a09807c50b7829c5f81d305a707dd9919
SHA3-384 hash: 1fa68b2343349bd872206cd6124d4d5f7e7a0b2ee48b881105e58f85b4a559d8a00c5eb698d1073d046b5f4368c8578d
SHA1 hash: 9ef71f53fca54c40573d793a92010e406e7e9994
MD5 hash: c9aeb8762e8eb56c8e4c166e017d0e80
humanhash: muppet-edward-georgia-oxygen
File name:virussign.com_c9aeb8762e8eb56c8e4c166e017d0e80
Download: download sample
Signature Cosmu
Create hunting rule
File size:116'274 bytes
First seen:2022-07-13 14:27:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8abecba2211e61763c4c9ffcaa13369e (172 x Cosmu, 1 x Zombie, 1 x CobaltStrike)
ssdeep 1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggA3X4lhkbw3MlyWayWirsVYLd:6e7WpHIyRF9ESWu0SWuDmSXrw3Mbrjd
Threatray 14 similar samples on MalwareBazaar
TLSH T1DBB36B27D620C0B7D785837001667E7DB4B830BABAE2DDF79B41CD4AB9B18719513243
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter KdssSupport
Tags:Cosmu exe


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
virussign.com_c9aeb8762e8eb56c8e4c166e017d0e80
Verdict:
No threats detected
Analysis date:
2022-07-14 02:08:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/10fb484e-a1c2-404a-b08e-30240885c162

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/287367/
Detection(s):
Win.Malware.Generickdz-9938530-0
Create hunting rule

Win.Trojan.Cosmu-1058
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed rat shell32.dll
Link:
https://www.filescan.io/uploads/62ced7390f510051d9efe138/reports/a737895e-fda2-44bb-9d39-90a9755da9ec/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Cosmu
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/50661b5b-18ea-4491-9880-8132a3ae2ed3
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1030795
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cecab83c0de9cb3ae4464198a4529d2a09807c50b7829c5f81d305a707dd9919/
Threat name:
Win32.Spyware.Zombie
Create hunting rule
Status:
Malicious
First seen:
2022-07-09 07:12:00 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
26 of 26 (100.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z3flqpan5hftvzcgigmkiuu5fieya7cqw6bjyx4b2mc2ob65temq._file
Verdict:
malicious
Similar samples:
0a53a78b2728beb7f8fb17135bd7c013aca9d7a2ec73d8c81542d7dfcad8bead
Cosmu
0fdb54ba8049a094328ce44539afd239e0b78f7e0a75e4709aaf00f9d26ebb93
Cosmu
3049c16e2b531f9fd1ab2a7e1ba95893e177714aaef0d956c2c19a9cfeee6d85
Cosmu
6757847f572bfe7d9d70d2dd8b18e2cd20794c6ee5af5c439d4d9d8778fe3d8a
Cosmu
89555cf1e213cb3caa646805b6ccf1625f86028b0040cb4100df7845c136515e
Cosmu
8cfbd5a0ecf044d8ba89254e88d54479593a1666e0e2882edcfb4d505610d175
Cosmu
c147611e7b8819ecbf4f4130d4000c7e01c1219b95ef9d89b11f802fbb6a46b1
Cosmu
cf97aa9c205191e8beefb7162cddadb5065445fe8cf2931fda9ef6e29c64a3d2
Cosmu
ead6d9b750649261aa9b52ea8cf053d1b8178c1e6a21680361ea6763d39ecb9e
Cosmu
ffd30ecdca3de5df82a5276690a913716be15d156cbc344b49866750d219717a
Cosmu
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220713-rs2kxsada9/
Unpacked files
SH256 hash:
cecab83c0de9cb3ae4464198a4529d2a09807c50b7829c5f81d305a707dd9919
MD5 hash:
c9aeb8762e8eb56c8e4c166e017d0e80
SHA1 hash:
9ef71f53fca54c40573d793a92010e406e7e9994
Link:
https://www.unpac.me/results/11cf9979-a04c-4e01-90f8-21dacb90de5a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/cecab83c0de9cb3ae4464198a4529d2a09807c50b7829c5f81d305a707dd9919

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Cosmu

Executable exe cecab83c0de9cb3ae4464198a4529d2a09807c50b7829c5f81d305a707dd9919

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/287367/

Comments