cosmicduke | 2026-08-19_d4a4200c80b7db0e80758e71b76ff62c_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

General

Target
2026-08-19_d4a4200c80b7db0e80758e71b76ff62c_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 1.1MB
Sample260819-btql2scd74
SHA256 aa5cca159e61b0dc67f19d1c54315ae688ae7e1f56610f1e8c4bbbadeb0fe83a
MD5 d4a4200c80b7db0e80758e71b76ff62c
SHA1 f5a7cbdc7efc93b9f6d742060cbee33c15470c6a
SHA512 a0e99efc84c849d22ce48e59f52f4d0636ab26c548c7f9ef3d786604dc5732c959fa9b95925202579463d4cc7261c25bdab0e91fa0929ba6e0bcb5555bdd4b93
SSDEEP 12288:Qe6TfPaGw/w+xorFD3/5xg1tKwchrrX/DmmxsgOJkO01Zj0Ve/75B:Qe6u/sFD3RSkDCmxs3nAh/
TLSH
T11C45AE3833E94071E03761788EE2F765C67AB83117E265DF2BD0867D5F22AD1A239706
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: CosmicDuke,TinyBaron
CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
stealer cosmicduke

Detects CosmicDuke or TinyBaron 1 IoCs

stealer apt apt29

resource	yara_rule
sample	family_cosmicduke

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_d4a4200c80b7db0e80758e71b76ff62c_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

2026-08-19_d4a4200c80b7db0e80758e71b76ff62c_amadey_coinminer_cosmicduke_elex_glassworm_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar

.exe 1.1MB

SHA256 aa5cca159e61b0dc67f19d1c54315ae688ae7e1f56610f1e8c4bbbadeb0fe83a
MD5 d4a4200c80b7db0e80758e71b76ff62c
SHA1 f5a7cbdc7efc93b9f6d742060cbee33c15470c6a
SHA512 a0e99efc84c849d22ce48e59f52f4d0636ab26c548c7f9ef3d786604dc5732c959fa9b95925202579463d4cc7261c25bdab0e91fa0929ba6e0bcb5555bdd4b93
SSDEEP 12288:Qe6TfPaGw/w+xorFD3/5xg1tKwchrrX/DmmxsgOJkO01Zj0Ve/75B:Qe6u/sFD3RSkDCmxs3nAh/
TLSH
T11C45AE3833E94071E03761788EE2F765C67AB83117E265DF2BD0867D5F22AD1A239706
MD5 SHA1 SHA512 SSDEEP TLSH

Detects CosmicDuke or TinyBaron

stealer apt apt29
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths