miniduke | 677a5726dd4b75654143f88e11fccfa5fc5176b0a972b60b6697949205f6eff5

General

Target
2026-06-03_9ae7f268279c2fb3b2104cc5e211826d_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.2MB
Sample260603-deex4saw5j
SHA256 677a5726dd4b75654143f88e11fccfa5fc5176b0a972b60b6697949205f6eff5
MD5 9ae7f268279c2fb3b2104cc5e211826d
SHA1 e744f9e7e2634f50fa384227d621fe6a54d237d3
SHA512 f2fc83efdfc254b11c5160005e1c745869090deb19c7b7acd786cc8f7ba8caed9fb284c05d2ed9f1449fed0fcd91a367873c1a290186c7e687a49f33dc5c80ba
SSDEEP 24576:3e6u/pjD3RS8lM2/4ZHfMoknwA6EiB8IMKOeyiI1O8Qn6EMKt0h7jA2V:3OBjzYHUFwxF8IMBBiItuihP9V
TLSH
T13FB52220B7C28073C12725B44AE5F7B85779BDA22BF299DF17C556B80F242C1927B31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-03_9ae7f268279c2fb3b2104cc5e211826d_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.2MB
- SHA256 677a5726dd4b75654143f88e11fccfa5fc5176b0a972b60b6697949205f6eff5
- MD5 9ae7f268279c2fb3b2104cc5e211826d
- SHA1 e744f9e7e2634f50fa384227d621fe6a54d237d3
- SHA512 f2fc83efdfc254b11c5160005e1c745869090deb19c7b7acd786cc8f7ba8caed9fb284c05d2ed9f1449fed0fcd91a367873c1a290186c7e687a49f33dc5c80ba
- SSDEEP 24576:3e6u/pjD3RS8lM2/4ZHfMoknwA6EiB8IMKOeyiI1O8Qn6EMKt0h7jA2V:3OBjzYHUFwxF8IMBBiItuihP9V
- TLSH
  T13FB52220B7C28073C12725B44AE5F7B85779BDA22BF299DF17C556B80F242C1927B31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt backdoor collection defense_evasion discovery miniduke spyware stealer
- Detects MiniDuke aka CosmicDuke or TinyBaron
  backdoor apt apt29
- Family: MiniDuke, CosmicDuke,TinyBaron
  MiniDuke aka CosmicDuke or TinyBaron is a backdoor used by the APT29 group, written in C++.
  backdoor miniduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2