cosmicduke | 2026-07-17_98070f227fe4e89f98ff70e2c0bd9a64_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

General

Target
2026-07-17_98070f227fe4e89f98ff70e2c0bd9a64_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 1.1MB
Sample260718-dbrshady5m
SHA256 f2c6fe1a544a3b4164947a8f371316e40969b6650b282b8b49b1c2fdb40a4981
MD5 98070f227fe4e89f98ff70e2c0bd9a64
SHA1 9e95af59ba5edc717505b2cf1846c9210a44b8df
SHA512 0a01a3b71b7aed9ecd0dd8117fee218de3e0819d9acdcc0cd32d183d5146c102078c90bd35da8cf2671c8cbd03df39ed0ff988665a059b639eea7dcdbe8982cd
SSDEEP 12288:Qe6TfPaGw/w+xoISD3/5xg1tKwcDrrX/DmmxsgZJkO01Zj0Vk/75B:Qe6u/XSD3RSqDCmxsQnAhB
TLSH
T12B45AE3833E98071E03751788EE2F765C67AB83117E265DF2BD0867D5F22AD1A239706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: CosmicDuke,TinyBaron
CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
stealer cosmicduke

Detects CosmicDuke or TinyBaron 1 IoCs

stealer apt apt29

resource	yara_rule
sample	family_cosmicduke

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_98070f227fe4e89f98ff70e2c0bd9a64_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

2026-07-17_98070f227fe4e89f98ff70e2c0bd9a64_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

.exe 1.1MB

SHA256 f2c6fe1a544a3b4164947a8f371316e40969b6650b282b8b49b1c2fdb40a4981
MD5 98070f227fe4e89f98ff70e2c0bd9a64
SHA1 9e95af59ba5edc717505b2cf1846c9210a44b8df
SHA512 0a01a3b71b7aed9ecd0dd8117fee218de3e0819d9acdcc0cd32d183d5146c102078c90bd35da8cf2671c8cbd03df39ed0ff988665a059b639eea7dcdbe8982cd
SSDEEP 12288:Qe6TfPaGw/w+xoISD3/5xg1tKwcDrrX/DmmxsgZJkO01Zj0Vk/75B:Qe6u/XSD3RSqDCmxsQnAhB
TLSH
T12B45AE3833E98071E03751788EE2F765C67AB83117E265DF2BD0867D5F22AD1A239706
MD5 SHA1 SHA512 SSDEEP TLSH

Detects CosmicDuke or TinyBaron

stealer apt apt29
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths