miniduke | 3f6a0dee02c54254941d1325612b853d5e7164f7db05fc8ed15b86c88595c5c1

General

Target
2026-05-30_2c4137c2c0612bba92bf04e4c8c3b84f_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.8MB
Sample260530-mnbfqact5j
SHA256 3f6a0dee02c54254941d1325612b853d5e7164f7db05fc8ed15b86c88595c5c1
MD5 2c4137c2c0612bba92bf04e4c8c3b84f
SHA1 7c8243a12e1003fa95f58a5c2441989e00677209
SHA512 1a3fb4910baf021eaa7af14565b8903363fdc6ba3c4cdf76f4ad96c0ec49f21085168b40a3638119209fd01dc4ba476e4ce81eff1945573c960410cbcb0ebcfa
SSDEEP 24576:ge6u/pjD3RST6AhuSDc9Df4fiNwSBaTwcEtyMyQeOaP1N1yJCils4ph77Qx89O3d:gOBjzYELakaityM7xaP17MhHa8+8
TLSH
T19FD5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-30_2c4137c2c0612bba92bf04e4c8c3b84f_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.8MB
- SHA256 3f6a0dee02c54254941d1325612b853d5e7164f7db05fc8ed15b86c88595c5c1
- MD5 2c4137c2c0612bba92bf04e4c8c3b84f
- SHA1 7c8243a12e1003fa95f58a5c2441989e00677209
- SHA512 1a3fb4910baf021eaa7af14565b8903363fdc6ba3c4cdf76f4ad96c0ec49f21085168b40a3638119209fd01dc4ba476e4ce81eff1945573c960410cbcb0ebcfa
- SSDEEP 24576:ge6u/pjD3RST6AhuSDc9Df4fiNwSBaTwcEtyMyQeOaP1N1yJCils4ph77Qx89O3d:gOBjzYELakaityM7xaP17MhHa8+8
- TLSH
  T19FD5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2