cosmicduke | 35f4a951672bcfc8661188fe1781a3d8306e89f1bd7c94ac7c9de199f4c35a77

General

Target
2026-08-30_0776059ed550691192e44518fdd4906f_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 1.7MB
Sample260830-15p74a1dmb
SHA256 35f4a951672bcfc8661188fe1781a3d8306e89f1bd7c94ac7c9de199f4c35a77
MD5 0776059ed550691192e44518fdd4906f
SHA1 fabd9f7e87448352695c8e0858a7eca6cddd41fa
SHA512 8830a8cb4b05c9e1b28232bd57d0bebf932de93932c72c78becc1a5a11ef5cc9300ed6c7dd2451a698ba99feea3f594c39545af60a9238ddb2ef4bd7a75ae99b
SSDEEP 24576:Re6u/O8D3RSZ0YKkktHyhjiSQgNcVal4ZMlmbZ:ROm8zYWGGlm5l4ZEEZ
TLSH
T10485122076C28073C22715784AE5F7B84B69BDA51BF6A9DF1BC507F90F242D2933631A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-30_0776059ed550691192e44518fdd4906f_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 1.7MB
- SHA256 35f4a951672bcfc8661188fe1781a3d8306e89f1bd7c94ac7c9de199f4c35a77
- MD5 0776059ed550691192e44518fdd4906f
- SHA1 fabd9f7e87448352695c8e0858a7eca6cddd41fa
- SHA512 8830a8cb4b05c9e1b28232bd57d0bebf932de93932c72c78becc1a5a11ef5cc9300ed6c7dd2451a698ba99feea3f594c39545af60a9238ddb2ef4bd7a75ae99b
- SSDEEP 24576:Re6u/O8D3RSZ0YKkktHyhjiSQgNcVal4ZMlmbZ:ROm8zYWGGlm5l4ZEEZ
- TLSH
  T10485122076C28073C22715784AE5F7B84B69BDA51BF6A9DF1BC507F90F242D2933631A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer upx
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2