cosmicduke | 46fc8f0ec6dc1c3d6f6b3ae29a27815b5b3325066075371b528973461355adef

General

Target
2026-08-20_a715cc24e35e67970ca659fa86742ec4_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 1.9MB
Sample260820-nsxeesbm2w
SHA256 46fc8f0ec6dc1c3d6f6b3ae29a27815b5b3325066075371b528973461355adef
MD5 a715cc24e35e67970ca659fa86742ec4
SHA1 3d326eb960af0206ddfb8226ee3ea5750081c496
SHA512 8b110f09aff74ca06f5c3e2f04f6dfeea8cb242dbaf88d4bb26d6243d00830d39f789459e398767928bacaf176b339e9904320af4c198df93981e41c2e6c5c1f
SSDEEP 24576:Re6u/O8D3RSZ0IKkktHy3jiJQkNVVaK4ZM5mb:ROm8zYGgGGKWK4ZQE
TLSH
T16C95122076C28073C22715784AE5F7B84B69BDA51BF6A9DF1BC507F90F242D2933631A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_a715cc24e35e67970ca659fa86742ec4_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 1.9MB
- SHA256 46fc8f0ec6dc1c3d6f6b3ae29a27815b5b3325066075371b528973461355adef
- MD5 a715cc24e35e67970ca659fa86742ec4
- SHA1 3d326eb960af0206ddfb8226ee3ea5750081c496
- SHA512 8b110f09aff74ca06f5c3e2f04f6dfeea8cb242dbaf88d4bb26d6243d00830d39f789459e398767928bacaf176b339e9904320af4c198df93981e41c2e6c5c1f
- SSDEEP 24576:Re6u/O8D3RSZ0IKkktHy3jiJQkNVVaK4ZM5mb:ROm8zYGgGGKWK4ZQE
- TLSH
  T16C95122076C28073C22715784AE5F7B84B69BDA51BF6A9DF1BC507F90F242D2933631A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer upx
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2