cosmicduke | 2026-07-10_e4f958de149e2e8262657ff73c3ea395_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-07-10_e4f958de149e2e8262657ff73c3ea395_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 1.0MB
Sample260710-vpl8lsds5p
SHA256 204b793baac401f5553c77be9270537ea99c70b2ebe6ad5784dfa7f61dbbf0f5
MD5 e4f958de149e2e8262657ff73c3ea395
SHA1 0e0c551c5d41233a6d90060969099f679c868ee6
SHA512 3553afc44fe36f8e95919ac3c9d656b15ecfc479e8f6ba87608cee59c9d663dfc8ec6640918751919bc0283b0988d47db5ff9ef08fea576fb41a8cddb77055f7
SSDEEP 12288:Se6TfPaGw/w+xomZD3/5xg1tKwc3rrX/Dmmxsg:Se6u/5ZD3RSqDCmxs
TLSH
T1F4359D3033D08072D16316748EE5F7A58A6EBC755BE199CF6BD90B7A2F246D1823930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: CosmicDuke,TinyBaron
CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
stealer cosmicduke

Detects CosmicDuke or TinyBaron 1 IoCs

stealer apt apt29

resource	yara_rule
sample	family_cosmicduke

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_e4f958de149e2e8262657ff73c3ea395_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

2026-07-10_e4f958de149e2e8262657ff73c3ea395_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee

.exe 1.0MB

SHA256 204b793baac401f5553c77be9270537ea99c70b2ebe6ad5784dfa7f61dbbf0f5
MD5 e4f958de149e2e8262657ff73c3ea395
SHA1 0e0c551c5d41233a6d90060969099f679c868ee6
SHA512 3553afc44fe36f8e95919ac3c9d656b15ecfc479e8f6ba87608cee59c9d663dfc8ec6640918751919bc0283b0988d47db5ff9ef08fea576fb41a8cddb77055f7
SSDEEP 12288:Se6TfPaGw/w+xomZD3/5xg1tKwc3rrX/Dmmxsg:Se6u/5ZD3RSqDCmxs
TLSH
T1F4359D3033D08072D16316748EE5F7A58A6EBC755BE199CF6BD90B7A2F246D1823930B
MD5 SHA1 SHA512 SSDEEP TLSH

Detects CosmicDuke or TinyBaron

stealer apt apt29
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths