cosmicduke | 2026-08-07_e70b2fe998f7c4ec01c0552cb6e1e4db_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

General

Target
2026-08-07_e70b2fe998f7c4ec01c0552cb6e1e4db_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 1.1MB
Sample260808-atrcxaag98
SHA256 e65612f0d6ef0c9dabfc99040367cc5e9f8ba9865ee9f20f9116889b923464a5
MD5 e70b2fe998f7c4ec01c0552cb6e1e4db
SHA1 357030cb035b5c717ae2fafd2c9e674213974dca
SHA512 ea2a7bc40a2307bf615e6cfdc024d13df210c54024a0226e6efcfbcf01d94020133633c66389932efaf92f2d8906300f7f7991cc18192cc15e82d18855f251e9
SSDEEP 12288:Qe6TfPaGw/w+xooFD3/5xg1tKwc5rrX/Dmmxsg7JkG01Zj03k/75B:Qe6u/fFD3RSMDCmxs+PAhj
TLSH
T1C645AE3833E940B1E03751788EE2F765C67AB83117E265DF2BD0867D5F22AD1A239706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer apt apt29 upx cosmicduke

Malware Config

Signatures

Family: CosmicDuke,TinyBaron
CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
stealer cosmicduke

Detects CosmicDuke or TinyBaron 1 IoCs

stealer apt apt29

resource	yara_rule
sample	family_cosmicduke

Custom signature

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_e70b2fe998f7c4ec01c0552cb6e1e4db_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

File Explorer

2026-08-07_e70b2fe998f7c4ec01c0552cb6e1e4db_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

.exe 1.1MB

2026-08-07_e70b2fe998f7c4ec01c0552cb6e1e4db_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

SHA256 e65612f0d6ef0c9dabfc99040367cc5e9f8ba9865ee9f20f9116889b923464a5
MD5 e70b2fe998f7c4ec01c0552cb6e1e4db
SHA1 357030cb035b5c717ae2fafd2c9e674213974dca
SHA512 ea2a7bc40a2307bf615e6cfdc024d13df210c54024a0226e6efcfbcf01d94020133633c66389932efaf92f2d8906300f7f7991cc18192cc15e82d18855f251e9
SSDEEP 12288:Qe6TfPaGw/w+xooFD3/5xg1tKwc5rrX/Dmmxsg7JkG01Zj03k/75B:Qe6u/fFD3RSMDCmxs+PAhj
TLSH
T1C645AE3833E940B1E03751788EE2F765C67AB83117E265DF2BD0867D5F22AD1A239706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects CosmicDuke or TinyBaron

stealer apt apt29
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_e70b2fe998f7c4ec01c0552cb6e1e4db_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

generic