miniduke | 89cae4caee014cc7c0d31e76fa1e2fc1964b4681ebb9c9a84385ba91c6c17d38

General

Target
2026-05-04_61f4d2954beeeb8979188b6a4b11223a_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.5MB
Sample260504-men1fsct2n
SHA256 89cae4caee014cc7c0d31e76fa1e2fc1964b4681ebb9c9a84385ba91c6c17d38
MD5 61f4d2954beeeb8979188b6a4b11223a
SHA1 a8d1bf46c0915807350a5ac5bae8c5f023d60c80
SHA512 d86aa72893b3291053cd4e020eaf1fbc1c9cad451c47a2c1e834391028ac622aa2f7b6b85a7c4506a38fb0ae19969494be52f318f59c4a08c74f3c1eccaaa56d
SSDEEP 24576:Re6u/O8D3RS50YKkytHy3jiGQLicV5K4ZM5mGmL1OGRm5ywK3eok/LPe:ROm8zY0gGZ+yK4ZQ5mL3/OoaLe
TLSH
T13AC512206F818072C12615B44EA0B7685625BE9237E75DFF26C732B8CF34EC29E76319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-04_61f4d2954beeeb8979188b6a4b11223a_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.5MB
- SHA256 89cae4caee014cc7c0d31e76fa1e2fc1964b4681ebb9c9a84385ba91c6c17d38
- MD5 61f4d2954beeeb8979188b6a4b11223a
- SHA1 a8d1bf46c0915807350a5ac5bae8c5f023d60c80
- SHA512 d86aa72893b3291053cd4e020eaf1fbc1c9cad451c47a2c1e834391028ac622aa2f7b6b85a7c4506a38fb0ae19969494be52f318f59c4a08c74f3c1eccaaa56d
- SSDEEP 24576:Re6u/O8D3RS50YKkytHy3jiGQLicV5K4ZM5mGmL1OGRm5ywK3eok/LPe:ROm8zY0gGZ+yK4ZQ5mL3/OoaLe
- TLSH
  T13AC512206F818072C12615B44EA0B7685625BE9237E75DFF26C732B8CF34EC29E76319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer upx
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2