cosmicduke | 2026-07-05_a85455bb2ea920f7b4a93552f9f0ac30_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-07-05_a85455bb2ea920f7b4a93552f9f0ac30_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 1.0MB
Sample260705-tesf7sdw4t
SHA256 4fb969032a11de8232bb996f17838e34d446ea174e6a5dfc5a9e704444befaa3
MD5 a85455bb2ea920f7b4a93552f9f0ac30
SHA1 d7bd26ebb998354bae87002fb583676302311a6e
SHA512 bf3271b6d9976ef3ac40182de48976811adb4aaf0c7c13f868b1472474d3670f64080e090976c2234c9806a8e9635639a00ccd56a52bbe8b15be2677da948d89
SSDEEP 12288:Se6TfPaGw/w+xoLMD3/5xg1tKwc8rrX/Dmmxsg:Se6u/IMD3RSXDCmxs
TLSH
T110359D3033D48072D16316748EE5F7A58A6EBC715BE199CF6BD90B7A2F246D1823930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: CosmicDuke,TinyBaron
CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
stealer cosmicduke

Detects CosmicDuke or TinyBaron 1 IoCs

stealer apt apt29

resource	yara_rule
sample	family_cosmicduke

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_a85455bb2ea920f7b4a93552f9f0ac30_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

2026-07-05_a85455bb2ea920f7b4a93552f9f0ac30_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 1.0MB

SHA256 4fb969032a11de8232bb996f17838e34d446ea174e6a5dfc5a9e704444befaa3
MD5 a85455bb2ea920f7b4a93552f9f0ac30
SHA1 d7bd26ebb998354bae87002fb583676302311a6e
SHA512 bf3271b6d9976ef3ac40182de48976811adb4aaf0c7c13f868b1472474d3670f64080e090976c2234c9806a8e9635639a00ccd56a52bbe8b15be2677da948d89
SSDEEP 12288:Se6TfPaGw/w+xoLMD3/5xg1tKwc8rrX/Dmmxsg:Se6u/IMD3RSXDCmxs
TLSH
T110359D3033D48072D16316748EE5F7A58A6EBC715BE199CF6BD90B7A2F246D1823930B
MD5 SHA1 SHA512 SSDEEP TLSH

Detects CosmicDuke or TinyBaron

stealer apt apt29
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths