cosmicduke | 4a534ccc818a36e5b81bcafeb07645c345a5ca24f81a0efac98e974d6bfff50a

General

Target
2026-07-02_e6be1d447516f61b380b795152dbf5a4_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.7MB
Sample260702-2bxkrafx3v
SHA256 4a534ccc818a36e5b81bcafeb07645c345a5ca24f81a0efac98e974d6bfff50a
MD5 e6be1d447516f61b380b795152dbf5a4
SHA1 ba42804c18252510182a73c977f72011d8b21e4c
SHA512 adddf8a73b221420ebda9967d214c78e5bffbf6fbfaef86bcc7e732b6029451650728266af5fa542a9673ff8b2bf2efa14457915e393c5b38dd81e78fa76ac5e
SSDEEP 24576:ge6u/pjD3RS2n3hJSDc9ifHfiq0AfBTxVclZMOJ0M7t1A1vdvi6s2hhWG8h8Jbgh:gOBjzYRK3M58lZMaZ7tawah9m8
TLSH
T179D5012C33EA10B2E43B50B8CD92B255D6B2B87127E265EF16D0C5BC4F266D5B239F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-02_e6be1d447516f61b380b795152dbf5a4_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.7MB
- SHA256 4a534ccc818a36e5b81bcafeb07645c345a5ca24f81a0efac98e974d6bfff50a
- MD5 e6be1d447516f61b380b795152dbf5a4
- SHA1 ba42804c18252510182a73c977f72011d8b21e4c
- SHA512 adddf8a73b221420ebda9967d214c78e5bffbf6fbfaef86bcc7e732b6029451650728266af5fa542a9673ff8b2bf2efa14457915e393c5b38dd81e78fa76ac5e
- SSDEEP 24576:ge6u/pjD3RS2n3hJSDc9ifHfiq0AfBTxVclZMOJ0M7t1A1vdvi6s2hhWG8h8Jbgh:gOBjzYRK3M58lZMaZ7tawah9m8
- TLSH
  T179D5012C33EA10B2E43B50B8CD92B255D6B2B87127E265EF16D0C5BC4F266D5B239F05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer adware persistence ransomware
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2