cosmicduke | 2edc639cc1b0c1977053490a5c73923995ad5bbb76217eb12302b943266292ab

General

Target
2026-10-14_41d5a70317e90ce82fd31acf0bbce19e_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.9MB
Sample261014-2np2fatvdy
SHA256 2edc639cc1b0c1977053490a5c73923995ad5bbb76217eb12302b943266292ab
MD5 41d5a70317e90ce82fd31acf0bbce19e
SHA1 99b3f43753a6b2d081fc7b6cfa3c31066ea4b6fa
SHA512 7161170770be8f1604f2080da485c89796d6a6f87a08c995ac772f77efe921803e60d5a4cc1855aaf55f66248d2405ac2e59e6e389f0dfaa50a755d3be0ac989
SSDEEP 24576:ce6u/i8D3RSw6Ahj1S+c4ifHfiq0iBjT8cUxhMOseNyS1U10nsilswxhWW8h8SOR:cOK8zYFK3UPyxhMzyySOZUhxm8
TLSH
T1C9D5022C33EA00B2E43B50B8CD96B255D6B2B87127E265EF16D0C5BC4F266D5B239F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-14_41d5a70317e90ce82fd31acf0bbce19e_coinminer_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 2.9MB
- SHA256 2edc639cc1b0c1977053490a5c73923995ad5bbb76217eb12302b943266292ab
- MD5 41d5a70317e90ce82fd31acf0bbce19e
- SHA1 99b3f43753a6b2d081fc7b6cfa3c31066ea4b6fa
- SHA512 7161170770be8f1604f2080da485c89796d6a6f87a08c995ac772f77efe921803e60d5a4cc1855aaf55f66248d2405ac2e59e6e389f0dfaa50a755d3be0ac989
- SSDEEP 24576:ce6u/i8D3RSw6Ahj1S+c4ifHfiq0iBjT8cUxhMOseNyS1U10nsilswxhWW8h8SOR:cOK8zYFK3UPyxhMzyySOZUhxm8
- TLSH
  T1C9D5022C33EA00B2E43B50B8CD96B255D6B2B87127E265EF16D0C5BC4F266D5B239F05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer upx
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2