miniduke | 1bc62ba0207d9e149eaba24da4ca86494d11bdffafd75920e06db7c5bc6735f7

General

Target
2026-05-06_d58efc40b170c6a826aa86c42ff02dcb_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 2.2MB
Sample260506-msph5sfx2s
SHA256 1bc62ba0207d9e149eaba24da4ca86494d11bdffafd75920e06db7c5bc6735f7
MD5 d58efc40b170c6a826aa86c42ff02dcb
SHA1 fcd57b940598fb2740cd649f2b4aef5b4fdc705b
SHA512 3ada79ac6321591a60405bd788bfbee5f8f92a287cdadd0d36d2b0f0c192c5fa14af07d69674d47f5cfb8517c0e33e62e9a90c54989184374e7b90e404c15574
SSDEEP 24576:Re6u/O8D3RSp0YKkQtHy3NaRQ8xcE5c8ZK5mh+L1osRd3cwKMWokvL6:ROm8zYygs+mXc8ZmW+LL0noie
TLSH
T190B52220B7C18073C12715B84AE5FBB85769BD622BF298DF17C556F80F642C2937A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-06_d58efc40b170c6a826aa86c42ff02dcb_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 2.2MB
- SHA256 1bc62ba0207d9e149eaba24da4ca86494d11bdffafd75920e06db7c5bc6735f7
- MD5 d58efc40b170c6a826aa86c42ff02dcb
- SHA1 fcd57b940598fb2740cd649f2b4aef5b4fdc705b
- SHA512 3ada79ac6321591a60405bd788bfbee5f8f92a287cdadd0d36d2b0f0c192c5fa14af07d69674d47f5cfb8517c0e33e62e9a90c54989184374e7b90e404c15574
- SSDEEP 24576:Re6u/O8D3RSp0YKkQtHy3NaRQ8xcE5c8ZK5mh+L1osRd3cwKMWokvL6:ROm8zYygs+mXc8ZmW+LL0noie
- TLSH
  T190B52220B7C18073C12715B84AE5FBB85769BD622BF298DF17C556F80F642C2937A31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer upx
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2