cosmicduke | 26e25f622ddda97b887a81b21be06962ccceeb83f0d230c033d50a2648200f0b

General

Target
2026-07-08_bbb03e52d435da76e886cbbf4bf72c28_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.2MB
Sample260708-ysybtsf14k
SHA256 26e25f622ddda97b887a81b21be06962ccceeb83f0d230c033d50a2648200f0b
MD5 bbb03e52d435da76e886cbbf4bf72c28
SHA1 fb223a599fa020ae30ac020390968f01cb0a03e1
SHA512 d7b0e2a34c15e96d474a37a7babda84c335931cf72e5361b6b015a4d6d2fed7a8ca0fa5fea670727b22a9c641fa905119b52dcb069f657703c92ec32fd9aa9e2
SSDEEP 24576:3e6u/pjD3RScFM2iDZHf6okawA6RiBv4MKOehFI1P8QN6EMKtBh79AXi:3OBjzYRCFFx6v4MBSFI+czhpsi
TLSH
T106B52220B7828073C12725B44AE5F7B85779BDA22BF299DF17C556B80F242C1927B31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_bbb03e52d435da76e886cbbf4bf72c28_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.2MB
- SHA256 26e25f622ddda97b887a81b21be06962ccceeb83f0d230c033d50a2648200f0b
- MD5 bbb03e52d435da76e886cbbf4bf72c28
- SHA1 fb223a599fa020ae30ac020390968f01cb0a03e1
- SHA512 d7b0e2a34c15e96d474a37a7babda84c335931cf72e5361b6b015a4d6d2fed7a8ca0fa5fea670727b22a9c641fa905119b52dcb069f657703c92ec32fd9aa9e2
- SSDEEP 24576:3e6u/pjD3RScFM2iDZHf6okawA6RiBv4MKOehFI1P8QN6EMKtBh79AXi:3OBjzYRCFFx6v4MBSFI+czhpsi
- TLSH
  T106B52220B7828073C12725B44AE5F7B85779BDA22BF299DF17C556B80F242C1927B31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer adware persistence ransomware
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2