miniduke | 1cc093ca9dd0da3c7c8a014234aac3a0f9d97062d5dab7d12bb041d036a6a86c

General

Target
2026-05-29_1e9447c200efcf2e9bb0814d0b3ee7fb_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.8MB
Sample260529-a73m4ae13p
SHA256 1cc093ca9dd0da3c7c8a014234aac3a0f9d97062d5dab7d12bb041d036a6a86c
MD5 1e9447c200efcf2e9bb0814d0b3ee7fb
SHA1 6d84f9d3c29664af14d64762fccbe51fd660a0dc
SHA512 cb37d1332708a9f582b4db44207515185030de8db662025253ba64af29973becb824a0a59c3ee868abd68b8aa41dc61fc6d4aa748a411e700d805b1b40bdfd30
SSDEEP 24576:ge6u/pjD3RSTnAhuSDc9Df4figwwBaTwcEtyMjQeOaP1N1yJ5ils4ph7OQx89O3d:gOBjzY9L1GaityM0xaP18MhSa8+8
TLSH
T1B9D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-29_1e9447c200efcf2e9bb0814d0b3ee7fb_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.8MB
- SHA256 1cc093ca9dd0da3c7c8a014234aac3a0f9d97062d5dab7d12bb041d036a6a86c
- MD5 1e9447c200efcf2e9bb0814d0b3ee7fb
- SHA1 6d84f9d3c29664af14d64762fccbe51fd660a0dc
- SHA512 cb37d1332708a9f582b4db44207515185030de8db662025253ba64af29973becb824a0a59c3ee868abd68b8aa41dc61fc6d4aa748a411e700d805b1b40bdfd30
- SSDEEP 24576:ge6u/pjD3RSTnAhuSDc9Df4figwwBaTwcEtyMjQeOaP1N1yJ5ils4ph7OQx89O3d:gOBjzY9L1GaityM0xaP18MhSa8+8
- TLSH
  T1B9D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2