miniduke | e548ed6c8d3d4772ef9e07391c01e117c135b4532a222d31e36cac515fe44a23

General

Target
2026-04-18_0e6a842763fab4bb36753479b1a63834_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.0MB
Sample260418-e3r31sgw3x
SHA256 e548ed6c8d3d4772ef9e07391c01e117c135b4532a222d31e36cac515fe44a23
MD5 0e6a842763fab4bb36753479b1a63834
SHA1 339f906e7c5868ac456a4a98afa75f971f623abb
SHA512 01671267c94a98c8558a6b180cb66f050a89cfe8bcdc1d24662dfcadacbb29f3339a9a3e2e578f8805abccaf298ce4dd45c1fb3e67206925535e90f004d8eed6
SSDEEP 24576:ge6u/pjD3RSmCAhJSEcfSfHfiq01hETxqkCZMOJ0e7t1k14dwi6su:gOBjzYIK37gzCZMaP7tycu
TLSH
T15CA5122833DA4072D53760788DA2F269D776B83227E265DF17D0C6BC0F266D1B23AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-18_0e6a842763fab4bb36753479b1a63834_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.0MB
- SHA256 e548ed6c8d3d4772ef9e07391c01e117c135b4532a222d31e36cac515fe44a23
- MD5 0e6a842763fab4bb36753479b1a63834
- SHA1 339f906e7c5868ac456a4a98afa75f971f623abb
- SHA512 01671267c94a98c8558a6b180cb66f050a89cfe8bcdc1d24662dfcadacbb29f3339a9a3e2e578f8805abccaf298ce4dd45c1fb3e67206925535e90f004d8eed6
- SSDEEP 24576:ge6u/pjD3RSmCAhJSEcfSfHfiq01hETxqkCZMOJ0e7t1k14dwi6su:gOBjzYIK37gzCZMaP7tycu
- TLSH
  T15CA5122833DA4072D53760788DA2F269D776B83227E265DF17D0C6BC0F266D1B23AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2