miniduke | 29501eadd058cf82bc9a0f1a0223a6049d2802e649731f5af812e193a50bc27e

General

Target
2026-05-03_2ffbb18e4777ea84b36fd548e464cf61_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 3.0MB
Sample260503-ltgn9aez2v
SHA256 29501eadd058cf82bc9a0f1a0223a6049d2802e649731f5af812e193a50bc27e
MD5 2ffbb18e4777ea84b36fd548e464cf61
SHA1 2933fa328cca4cc1ceee127f62d90236c4f3d5bb
SHA512 16207d9b507c26c1f22d1f0b884325c5f5ca0b916dc5e6de38ea5e4c772f60d1374aef899dc64219a5aa5185a9239107f8ec7edc07d839e5e9d863077efdda85
SSDEEP 49152:gOBjzY7K1QjNFyTzaaP1HfhIE8+8HOm8zW:HejNFE5OE87
TLSH
T161E5F12C33EA00B2E5376178C992B255E672B83127E265EF17D0C27C4F27AD5B239B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-03_2ffbb18e4777ea84b36fd548e464cf61_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 3.0MB
- SHA256 29501eadd058cf82bc9a0f1a0223a6049d2802e649731f5af812e193a50bc27e
- MD5 2ffbb18e4777ea84b36fd548e464cf61
- SHA1 2933fa328cca4cc1ceee127f62d90236c4f3d5bb
- SHA512 16207d9b507c26c1f22d1f0b884325c5f5ca0b916dc5e6de38ea5e4c772f60d1374aef899dc64219a5aa5185a9239107f8ec7edc07d839e5e9d863077efdda85
- SSDEEP 49152:gOBjzY7K1QjNFyTzaaP1HfhIE8+8HOm8zW:HejNFE5OE87
- TLSH
  T161E5F12C33EA00B2E5376178C992B255E672B83127E265EF17D0C27C4F27AD5B239B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2