cosmicduke | a29f68c5123e601c68283589f0b78a65a5c357622348054a9b10797c465024c1

General

Target
2026-08-03_4b397632aa987e53ee4055d2f8b4ed8a_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.8MB
Sample260803-n5dg3sha56
SHA256 a29f68c5123e601c68283589f0b78a65a5c357622348054a9b10797c465024c1
MD5 4b397632aa987e53ee4055d2f8b4ed8a
SHA1 5c54829c709173fe6758c86d0c475f21a7a51e12
SHA512 3e41254348f2c6a7aa6d104d45c1e58976dbf39b9e5437c052b0b311d1b6051f8d869164c26ca83036ca68889e8c522b11801a9c3b03030bd59d6228845db91c
SSDEEP 24576:ge6u/pjD3RS2PAnfqDc9gfpfibSDOcT8chzyVO4eoOP1ziSB+RBsTeh7V8089O3d:gOBjzYCcuK4rzyV3zOPkGyhZv8+8
TLSH
T176D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_4b397632aa987e53ee4055d2f8b4ed8a_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.8MB
- SHA256 a29f68c5123e601c68283589f0b78a65a5c357622348054a9b10797c465024c1
- MD5 4b397632aa987e53ee4055d2f8b4ed8a
- SHA1 5c54829c709173fe6758c86d0c475f21a7a51e12
- SHA512 3e41254348f2c6a7aa6d104d45c1e58976dbf39b9e5437c052b0b311d1b6051f8d869164c26ca83036ca68889e8c522b11801a9c3b03030bd59d6228845db91c
- SSDEEP 24576:ge6u/pjD3RS2PAnfqDc9gfpfibSDOcT8chzyVO4eoOP1ziSB+RBsTeh7V8089O3d:gOBjzYCcuK4rzyV3zOPkGyhZv8+8
- TLSH
  T176D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2