miniduke | e0efc1621f06a9cd23c010c7a67d8ba8012d9513982293362589cfcf8bae2a09

General

Target
2026-04-24_4d486ca2c277427fcccf8533ecdb31cf_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 2.2MB
Sample260424-e5m7vabt8p
SHA256 e0efc1621f06a9cd23c010c7a67d8ba8012d9513982293362589cfcf8bae2a09
MD5 4d486ca2c277427fcccf8533ecdb31cf
SHA1 765c9ed01e8a73fc6a4f9b50a11d1363baed95f0
SHA512 aef85a312b65fc7bc7a97eab4a768d24e3a4ef8de5e5de4b6fbffe693ebf80c5197a3033286f5ee42e419dcd68d98e5a70a4a49775d1694485d0ec1062ba1df3
SSDEEP 24576:Re6u/O8D3RSJiYKhytHyjjivQbxc2T38GM5myiL1efRm5ywKMeokoL6:ROm8zYt0GItv38GQliLm//ode
TLSH
T1F6B52220B7C18073C12715B84AE5FBB85769BD622BF298DF17C556F80F642C2937A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-24_4d486ca2c277427fcccf8533ecdb31cf_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 2.2MB
- SHA256 e0efc1621f06a9cd23c010c7a67d8ba8012d9513982293362589cfcf8bae2a09
- MD5 4d486ca2c277427fcccf8533ecdb31cf
- SHA1 765c9ed01e8a73fc6a4f9b50a11d1363baed95f0
- SHA512 aef85a312b65fc7bc7a97eab4a768d24e3a4ef8de5e5de4b6fbffe693ebf80c5197a3033286f5ee42e419dcd68d98e5a70a4a49775d1694485d0ec1062ba1df3
- SSDEEP 24576:Re6u/O8D3RSJiYKhytHyjjivQbxc2T38GM5myiL1efRm5ywKMeokoL6:ROm8zYt0GItv38GQliLm//ode
- TLSH
  T1F6B52220B7C18073C12715B84AE5FBB85769BD622BF298DF17C556F80F642C2937A31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer upx
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2