miniduke | 998a4a07cd873a7b3083810b96336c24e7d73f12b79d9b5d0744ff7b45a85783

General

Target
2026-05-19_27ae886a90bb788cbc686590cd507217_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.8MB
Sample260519-d417msbv6k
SHA256 998a4a07cd873a7b3083810b96336c24e7d73f12b79d9b5d0744ff7b45a85783
MD5 27ae886a90bb788cbc686590cd507217
SHA1 9a818871613913691e913d07ce3f04869a1304e1
SHA512 32cefec681c9d55d7115cef00cdf788d8e7ab5d9a18f5190e4125f4fd58781d7c12479a8635d41206f166f992ce489e1f89f15c6083b08478e51b68c2544e79d
SSDEEP 24576:ge6u/pjD3RS7nFhuSDcRDf4figw3BaTwcYYyMHQeoaP1N1yJ2ilsFCh7DQx89O3d:gOBjzYiL1xaOYyMwXaP1H8hPa8+8
TLSH
T142D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-19_27ae886a90bb788cbc686590cd507217_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.8MB
- SHA256 998a4a07cd873a7b3083810b96336c24e7d73f12b79d9b5d0744ff7b45a85783
- MD5 27ae886a90bb788cbc686590cd507217
- SHA1 9a818871613913691e913d07ce3f04869a1304e1
- SHA512 32cefec681c9d55d7115cef00cdf788d8e7ab5d9a18f5190e4125f4fd58781d7c12479a8635d41206f166f992ce489e1f89f15c6083b08478e51b68c2544e79d
- SSDEEP 24576:ge6u/pjD3RS7nFhuSDcRDf4figw3BaTwcYYyMHQeoaP1N1yJ2ilsFCh7DQx89O3d:gOBjzYiL1xaOYyMwXaP1H8hPa8+8
- TLSH
  T142D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2