cosmicduke | 2026-08-09_3f2e6dbb384a8aef7e0a1446d4d4954d_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

General

Target
2026-08-09_3f2e6dbb384a8aef7e0a1446d4d4954d_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 1.1MB
Sample260809-hptapsbk3v
SHA256 dd99c596dc51205434fd636dec84f104fecae6326abe3bd53e411dfd31613284
MD5 3f2e6dbb384a8aef7e0a1446d4d4954d
SHA1 eb0642f76607b76caea2c3e9f00a795631f9a91b
SHA512 5acb8658067a914531ca59a4952a15f15a186dd0ab6856a544093ddcb93bc7e40ba255bd6085fff476ca83caf8e47688d4f6daca096fabeeea0612e29be4b79e
SSDEEP 12288:Qe6TfPaGw/w+xo3tD3/5xg1tKwc2rrX/Dmmxsg6Jxq01Zj03k/75B:Qe6u/wtD3RSxDCmxsTUAhj
TLSH
T15045AE3833E98071E03751788EE2F765C67AB83117E265DF2BD0867D5F22AD1A239706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: CosmicDuke,TinyBaron
CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
stealer cosmicduke

Detects CosmicDuke or TinyBaron 1 IoCs

stealer apt apt29

resource	yara_rule
sample	family_cosmicduke

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_3f2e6dbb384a8aef7e0a1446d4d4954d_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

2026-08-09_3f2e6dbb384a8aef7e0a1446d4d4954d_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

.exe 1.1MB

SHA256 dd99c596dc51205434fd636dec84f104fecae6326abe3bd53e411dfd31613284
MD5 3f2e6dbb384a8aef7e0a1446d4d4954d
SHA1 eb0642f76607b76caea2c3e9f00a795631f9a91b
SHA512 5acb8658067a914531ca59a4952a15f15a186dd0ab6856a544093ddcb93bc7e40ba255bd6085fff476ca83caf8e47688d4f6daca096fabeeea0612e29be4b79e
SSDEEP 12288:Qe6TfPaGw/w+xo3tD3/5xg1tKwc2rrX/Dmmxsg6Jxq01Zj03k/75B:Qe6u/wtD3RSxDCmxsTUAhj
TLSH
T15045AE3833E98071E03751788EE2F765C67AB83117E265DF2BD0867D5F22AD1A239706
MD5 SHA1 SHA512 SSDEEP TLSH

Detects CosmicDuke or TinyBaron

stealer apt apt29
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths