cosmicduke | 4e0c3df00c43a9b32c4d387fdc20fee7abf3fca1b749b3cb8fa6a71598aa11b1

General

Target
2026-08-07_df294c49979b1eb7f64ec974b53dc171_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 2.2MB
Sample260807-d9f4nazves
SHA256 4e0c3df00c43a9b32c4d387fdc20fee7abf3fca1b749b3cb8fa6a71598aa11b1
MD5 df294c49979b1eb7f64ec974b53dc171
SHA1 84b4c150a23bb3e393aa374c1373f27cecdae6e4
SHA512 2878311869d2cd00c3e76f3eac09fee4e5f8088f7e807d1a6de9bcbe0a913da2e82c9ef1ac157560ddbf82b78dcd64108aef02fc8001d4b5ef4c4797b122827f
SSDEEP 24576:Re6u/O8D3RSJSYKhytHyjji6H7xc8T3TGM5mE7L1Ef:ROm8zY90GeNx3TGQj7LE
TLSH
T158B5122076C58073C22729B449E5F7B85B6ABDA21BF299DF17C507B90F283C1937631A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-07_df294c49979b1eb7f64ec974b53dc171_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 2.2MB
- SHA256 4e0c3df00c43a9b32c4d387fdc20fee7abf3fca1b749b3cb8fa6a71598aa11b1
- MD5 df294c49979b1eb7f64ec974b53dc171
- SHA1 84b4c150a23bb3e393aa374c1373f27cecdae6e4
- SHA512 2878311869d2cd00c3e76f3eac09fee4e5f8088f7e807d1a6de9bcbe0a913da2e82c9ef1ac157560ddbf82b78dcd64108aef02fc8001d4b5ef4c4797b122827f
- SSDEEP 24576:Re6u/O8D3RSJSYKhytHyjji6H7xc8T3TGM5mE7L1Ef:ROm8zY90GeNx3TGQj7LE
- TLSH
  T158B5122076C58073C22729B449E5F7B85B6ABDA21BF299DF17C507B90F283C1937631A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer upx
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2