miniduke | 4698769b43d54f14068b979838c7e033752798e3de84edcccc361602d8071fe2

General

Target
2026-05-25_2f57b9594774dc876a649b10e7602b7c_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.2MB
Sample260525-ltwheags5t
SHA256 4698769b43d54f14068b979838c7e033752798e3de84edcccc361602d8071fe2
MD5 2f57b9594774dc876a649b10e7602b7c
SHA1 9a5084944663e294c227ea6d914a55eccbb8ce37
SHA512 73ebbc1a6b7c0b3306ee33d21a6418b2ba87b66039bf502c44e25eb8e9c27bb2de8f038427864ac8f1d1f0c7ed1f8f968474b3c9dd11872d7ee365e9b1cad1da
SSDEEP 24576:He6u/I8D3RSASAhj3ZDR9ifLfiq42hZToV+iZLOJ0F7X1016nziBsIehWZ:HOg8zYHebwx5iZLao7XikThK
TLSH
T105B5122873DA4072D13760B88D92B265D776B83227F265EF17D0C6BC0F266D1B23AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-25_2f57b9594774dc876a649b10e7602b7c_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.2MB
- SHA256 4698769b43d54f14068b979838c7e033752798e3de84edcccc361602d8071fe2
- MD5 2f57b9594774dc876a649b10e7602b7c
- SHA1 9a5084944663e294c227ea6d914a55eccbb8ce37
- SHA512 73ebbc1a6b7c0b3306ee33d21a6418b2ba87b66039bf502c44e25eb8e9c27bb2de8f038427864ac8f1d1f0c7ed1f8f968474b3c9dd11872d7ee365e9b1cad1da
- SSDEEP 24576:He6u/I8D3RSASAhj3ZDR9ifLfiq42hZToV+iZLOJ0F7X1016nziBsIehWZ:HOg8zYHebwx5iZLao7XikThK
- TLSH
  T105B5122873DA4072D13760B88D92B265D776B83227F265EF17D0C6BC0F266D1B23AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer upx
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2