miniduke | b9c16945f788f229f71ce1d010b3da6f17cf21f1151aca0e7f77a3c852f166e4

General

Target
2026-05-07_91e3e314f34c07efcc9fdda2449da6d8_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 1.2MB
Sample260507-ethg8aex8x
SHA256 b9c16945f788f229f71ce1d010b3da6f17cf21f1151aca0e7f77a3c852f166e4
MD5 91e3e314f34c07efcc9fdda2449da6d8
SHA1 575f1727e92091f1c5f49d29437e6de76b1b4b8c
SHA512 5930bd02efd9fd236dcd350f81b091175e5dfc26af8cfcd49b5bf2024d550e56582089693df8c33184209fff8dd817aceb92ca66d35dda938114f792aed0231a
SSDEEP 12288:3e6TfPaGw/w+xoWjD3/5xg1tKwcpa58VLfG4RVeZtP8efaX/AsQRC05xYfoUR46u:3e6u/pjD3RS8lbGi4ZHf6opWwx6Erl
TLSH
T18A55012076C58073D62725744AF5F7B84B69BDA21BF1A9CF2BC506BD0F246D2833631A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-07_91e3e314f34c07efcc9fdda2449da6d8_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 1.2MB
- SHA256 b9c16945f788f229f71ce1d010b3da6f17cf21f1151aca0e7f77a3c852f166e4
- MD5 91e3e314f34c07efcc9fdda2449da6d8
- SHA1 575f1727e92091f1c5f49d29437e6de76b1b4b8c
- SHA512 5930bd02efd9fd236dcd350f81b091175e5dfc26af8cfcd49b5bf2024d550e56582089693df8c33184209fff8dd817aceb92ca66d35dda938114f792aed0231a
- SSDEEP 12288:3e6TfPaGw/w+xoWjD3/5xg1tKwcpa58VLfG4RVeZtP8efaX/AsQRC05xYfoUR46u:3e6u/pjD3RS8lbGi4ZHf6opWwx6Erl
- TLSH
  T18A55012076C58073D62725744AF5F7B84B69BDA21BF1A9CF2BC506BD0F246D2833631A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2