cosmicduke | 394f0563bd61465a850e5d62c294cdc6e13ee42f64ced9602dd68dcf5d41af17

General

Target
2026-10-22_afdaf82c2fd7df7461273ff1ef8607ac_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 2.2MB
Sample261024-ap12js1xby
SHA256 394f0563bd61465a850e5d62c294cdc6e13ee42f64ced9602dd68dcf5d41af17
MD5 afdaf82c2fd7df7461273ff1ef8607ac
SHA1 c49f4421fb636f5e688a838980e9e1f0db37c537
SHA512 6206f94aa2f0606e460c86088f0216ba836caf6c0f6c2001af607e0f5bfd7c3439442ba3ff3d7d7eca4350c599cc3ed33d7f6c884c28edbd811095da77caa317
SSDEEP 24576:Pe6u/p6D3RSvZo20OfufR/+uNegE7vT4MKzeBW510N4n6EvKK6h7UAN3:POB6zYR2mQJuT4MoqW5q9dhAy3
TLSH
T11DB52220B7828073C22725B44AE5F7B85779BDA22BF299DF17C556F80F242C1927731A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-22_afdaf82c2fd7df7461273ff1ef8607ac_cosmicduke_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 2.2MB
- SHA256 394f0563bd61465a850e5d62c294cdc6e13ee42f64ced9602dd68dcf5d41af17
- MD5 afdaf82c2fd7df7461273ff1ef8607ac
- SHA1 c49f4421fb636f5e688a838980e9e1f0db37c537
- SHA512 6206f94aa2f0606e460c86088f0216ba836caf6c0f6c2001af607e0f5bfd7c3439442ba3ff3d7d7eca4350c599cc3ed33d7f6c884c28edbd811095da77caa317
- SSDEEP 24576:Pe6u/p6D3RSvZo20OfufR/+uNegE7vT4MKzeBW510N4n6EvKK6h7UAN3:POB6zYR2mQJuT4MoqW5q9dhAy3
- TLSH
  T11DB52220B7828073C22725B44AE5F7B85779BDA22BF299DF17C556F80F242C1927731A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt29 apt collection defense_evasion discovery cosmicduke spyware stealer
- Detects CosmicDuke or TinyBaron
  stealer apt apt29
- Family: CosmicDuke,TinyBaron
  CosmicDuke aka TinyBaron is an information stealer used by the APT29 group.
  stealer cosmicduke
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2