cosmicduke | 161c6d2d3d86068591719aa9fcd4e2d650d39aeaa5f40b33ac1753481a6e1f1c

General

Target
2026-08-16_316eaf871d780a6b7834f128cd8bcdc8_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.9MB
Sample260816-j5c44acb84
SHA256 161c6d2d3d86068591719aa9fcd4e2d650d39aeaa5f40b33ac1753481a6e1f1c
MD5 316eaf871d780a6b7834f128cd8bcdc8
SHA1 883eb4d22ce0102c930091c03193ab1a4aa87169
SHA512 ed07e54534671b061f2d040ae82d88d45325525e4c2205056153bc490e96eac5d930449f7e5bd822f688689449474f1275cf6f8fe687f885bfd8ea0b8d79d8af
SSDEEP 24576:ce6u/i8D3RSgnDFj1yDc9efHfihD38PThnUBhMOneVDP1SIWhVFe/reh7L8r8SOD:cOK8zYDKZsbKBhM46DPlVahH8818
TLSH
T1D8E5F12C23EA10B5E43B607CC992B255E6B2B43127E262EF16D0C17C4F276D9B639F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-16_316eaf871d780a6b7834f128cd8bcdc8_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.9MB
- SHA256 161c6d2d3d86068591719aa9fcd4e2d650d39aeaa5f40b33ac1753481a6e1f1c
- MD5 316eaf871d780a6b7834f128cd8bcdc8
- SHA1 883eb4d22ce0102c930091c03193ab1a4aa87169
- SHA512 ed07e54534671b061f2d040ae82d88d45325525e4c2205056153bc490e96eac5d930449f7e5bd822f688689449474f1275cf6f8fe687f885bfd8ea0b8d79d8af
- SSDEEP 24576:ce6u/i8D3RSgnDFj1yDc9efHfihD38PThnUBhMOneVDP1SIWhVFe/reh7L8r8SOD:cOK8zYDKZsbKBhM46DPlVahH8818
- TLSH
  T1D8E5F12C23EA10B5E43B607CC992B255E6B2B43127E262EF16D0C17C4F276D9B639F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer upx
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2