2026-03-14_01156a35da7bdca45710da07d5116e14_amadey_cosmicduke_elex_glassworm_smoke-loader_tofsee
Classification: Malicious
2026-03-14_01156a35da7bdca45710da07d5116e14_amadey_cosmicduke_elex_glassworm_smoke-loader_tofsee is a trojan. Detected by 74 antivirus engines.
Detection summary
- 74 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: MINIDUKE (S0051)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Miniduke | Triage | 2026-03-14 13:52:20 | 2026-03-14 13:52:20 | malicious-activity | S0051 MiniDuke |
Tags
miniduke apt29 apt backdoor discoverySample information
- Filenames
- 2026-03-14_01156a35da7bdca45710da07d5116e14_amadey_cosmicduke_elex_glassworm_smoke-loader_tofsee
- MD5
01156a35da7bdca45710da07d5116e14- SHA-1
5e95e8e72e7394b0083208ff96a2bef5e6cfb9dd- SHA-256
eb6dff9d3db7b186ec6e4fa65ba50537dc7a71dfaeaa46bb827ef7d12c0eeddc- SHA-512
b29d92ec09da1d5d456b7bbfbec6776af3cdbc1d5408390da488213f6610ff2af09f96c017996eacc8e3a49f07b0e7ade6b41533b942718a35fc114942051f89- First indexed
- 2026-03-14 13:52:20
- Last updated
- 2026-10-11 02:49:24
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Agent.DHDV |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Bd] |
| AhnLab-V3 | Backdoor/Win32.CosmicDuke.C3862490 |
| Antiy-AVL | Trojan[Backdoor]/Win32.CosmicDuke |
| Arcabit | Trojan.Agent.DHDV |
| Avast | Win32:MalwareX-gen [Bd] |
| Avira | HEUR/AGEN.1367220 |
| BitDefender | Trojan.Agent.DHDV |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| CTX | exe.trojan.dhdv |
| ClamAV | Win.Trojan.Zusy-9876296-0 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | BackDoor.Miniduke.4 |
| ESET-NOD32 | Win32/Agent.RLQ trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Agent.DHDV (B) |
| F-Secure | Heuristic.HEUR/AGEN.1367220 |
| Fortinet | W32/Agent.NYS!tr |
| GData | Trojan.Agent.DHDV |
| Detected | |
| Gridinsoft | Trojan.Win32.Agent.oa!s1 |
| Ikarus | Trojan-Ransom.Locky |
| Jiangmin | Backdoor.CosmicDuke.i |
| K7AntiVirus | Backdoor ( 005d13461 ) |
| K7GW | Backdoor ( 005d13461 ) |
| Kaspersky | HEUR:Backdoor.Win32.CosmicDuke.gen |
| Kingsoft | malware.kb.a.947 |
| Malwarebytes | Malware.AI.1744403880 |
| McAfeeD | ti!EB6DFF9D3DB7 |
| MicroWorld-eScan | Trojan.Agent.DHDV |
| Microsoft | Backdoor:Win32/Miniduke!pz |
| NANO-Antivirus | Trojan.Win32.CosmicDuke.fiulvj |
| Panda | Trj/Genetic.gen |
| Rising | Backdoor.Miniduke!8.4821 (TFE:5:0qr9JGxWvrK) |
| SUPERAntiSpyware | Backdoor.CosmicDuke/Variant |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.NetLoader.ch |
| Sophos | Mal/SwiftG-S |
| TACHYON | Backdoor/W32.CosmicDuke.178688 |
| Tencent | Backdoor.Win32.CosmicDuke.ha |
| Trapmine | suspicious.low.ml.score |
| TrellixENS | Trojan-FHFD!01156A35DA7B |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9z |
| VBA32 | Backdoor.CosmicDuke |
| VIPRE | Trojan.Agent.DHDV |
| Varist | W32/Agent.XPUQ-0460 |
| VirIT | Backdoor.Win32.Miniduke.E |
| Webroot | W32.Malware.Gen |
| Yandex | Trojan.GenAsa!ccJ9khjd0EY |
| Zillya | Backdoor.CosmicDuke.Win32.19 |
| ZoneAlarm | Mal/SwiftG-S |
| Zoner | Trojan.Win32.74277 |
| alibabacloud | Backdoor:Win/Miniduke.f40a16ae |
| huorong | TrojanDropper/Agent.da |
| Alibaba | Malware:Win32/km_2c56d.None |
| Avira | BDS/W32.MalwareX |
| Bkav | W32.Malware.781E27C2 |
| CTX | exe.backdoor.cosmicduke |
| CrowdStrike | win/malicious_confidence_100% (W) |
| F-Secure | Backdoor.BDS/W32.MalwareX |
| Kingsoft | Win32.Hack.CosmicDuke.gen |
| Lionic | Trojan.Win32.CosmicDuke.m!c |
| Malwarebytes | Generic.Backdoor.Bot.DDS |
| MaxSecure | Trojan.Malware.74123479.susgen |
| McAfeeD | Trojan:Win/MiniDuke.VYU |
| Paloalto | generic.ml |
| Symantec | ML.Attribute.HighConfidence |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04CA5 |