cosmicduke | 71a6a88b6e2ea4bb8c49588dcfc8f739aaf60ed96736d792714660523dbbdaf9

General

Target
2026-07-09_10ec8191991571afca6b4b2962a3e575_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.8MB
Sample260709-npbcsahv6n
SHA256 71a6a88b6e2ea4bb8c49588dcfc8f739aaf60ed96736d792714660523dbbdaf9
MD5 10ec8191991571afca6b4b2962a3e575
SHA1 d0e53d360ac6497ca99405e0d530a5a1c8931cdd
SHA512 fc2fe09e0f2f2b40fa8500a4436780869cf2985e308f34427ffb27fbde8ddebd5e522b2a2c480ae54bbde8a271876d8a30f2dca3ec0e4cd2ecfc690a16e40aff
SSDEEP 24576:ge6u/pjD3RSLnFhuS7JRVf4figwSBtTwcYYyMHQeoaP1D1y52ilsJCh7KQx89O3d:gOBjzYxL1kFOYyMwXaPL3ohGa8+8
TLSH
T1F1D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_10ec8191991571afca6b4b2962a3e575_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.8MB
- SHA256 71a6a88b6e2ea4bb8c49588dcfc8f739aaf60ed96736d792714660523dbbdaf9
- MD5 10ec8191991571afca6b4b2962a3e575
- SHA1 d0e53d360ac6497ca99405e0d530a5a1c8931cdd
- SHA512 fc2fe09e0f2f2b40fa8500a4436780869cf2985e308f34427ffb27fbde8ddebd5e522b2a2c480ae54bbde8a271876d8a30f2dca3ec0e4cd2ecfc690a16e40aff
- SSDEEP 24576:ge6u/pjD3RSLnFhuS7JRVf4figwSBtTwcYYyMHQeoaP1D1y52ilsJCh7KQx89O3d:gOBjzYxL1kFOYyMwXaPL3ohGa8+8
- TLSH
  T1F1D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery apt29 adware apt collection defense_evasion cosmicduke persistence ransomware spyware stealer
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2