cosmicduke | f4f9154b973a898a23ee694f08ffbb3aca8f0c2c583e44e53e29129c36d83d62

General

Target
2026-08-08_e71c6f3c4945a26836760dfaaab5fb8b_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.8MB
Sample260808-lpcvhacg59
SHA256 f4f9154b973a898a23ee694f08ffbb3aca8f0c2c583e44e53e29129c36d83d62
MD5 e71c6f3c4945a26836760dfaaab5fb8b
SHA1 352f4914191b744a9398e6fb9876ae84003a3037
SHA512 7219b93de038d4da6ba98c633d014313e5bbd5571c49d4abce723e2aab2ca595a7ca2d685d3c47bca97a9f431c43752456cfcf5491f93fbc5b1de11b84044f38
SSDEEP 24576:ge6u/pjD3RSjZAnfXDc8gfpfib0k1cT8KhPyVOQe4aP1Vj9B+RBs8eh7k8089O3d:gOBjzY3c4+4dPyV/jaPThPhIv8+8
TLSH
T133D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_e71c6f3c4945a26836760dfaaab5fb8b_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.8MB
- SHA256 f4f9154b973a898a23ee694f08ffbb3aca8f0c2c583e44e53e29129c36d83d62
- MD5 e71c6f3c4945a26836760dfaaab5fb8b
- SHA1 352f4914191b744a9398e6fb9876ae84003a3037
- SHA512 7219b93de038d4da6ba98c633d014313e5bbd5571c49d4abce723e2aab2ca595a7ca2d685d3c47bca97a9f431c43752456cfcf5491f93fbc5b1de11b84044f38
- SSDEEP 24576:ge6u/pjD3RSjZAnfXDc8gfpfib0k1cT8KhPyVOQe4aP1Vj9B+RBs8eh7k8089O3d:gOBjzY3c4+4dPyV/jaPThPhIv8+8
- TLSH
  T133D5F12C23EA10B5E43B607CC992B255E672B43127E262EF16D0C17C4F27AD9B639F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2