cfb3accdf0f90d4e56a51f6b82eeaf96b6c9f8f7cd9f58e5c996ff1f515d19c6

Sharing

Copy URL Twitter E-mail

General

Target
cmder_mini.zip
Size 12.2MB
Sample261110-pk8cdstshx
SHA256 cfb3accdf0f90d4e56a51f6b82eeaf96b6c9f8f7cd9f58e5c996ff1f515d19c6
MD5 70d746930c7a4450c87e45123cb1a6c4
SHA1 0d18ace9916667a31b1a25546a7c438c499c5e50
SHA512 cbd50898025d723a1e03b16eef1807ac8d98df65e9deb8edde411008c53fd05589be26398629a93a44bc9d2e383b8586191422dbf61fd58df4b8d4bfe6850b57
SSDEEP 196608:gDtoBEfB8h9SJuwvEaPEngM4+6NKiFDcdjRCnKwpFv4Ucjr2C+5YvBQJVFtuv1SX:gKBj60ngMOtDK447id
TLSH
T1A4D633568A065504FF022E3B8F4FE68CE7E140D7763AF28B3DB93555190BA802FDE256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Cmder.exe
- Size 161KB
- SHA256 94fdb85080488ea5e18e202b44259a229b0198facfa5cefc8902de0184cae817
- MD5 7241c7e99a056a3a01bc5610e749a435
- SHA1 18464d67788b02a34e27ba8c3f797e1abb196090
- SHA512 966548644e9c3abe5b4cbd09e743f41d13f3df2e29d1d4f50714aaa6c81248d718a9b254df91302c768b99102cb60f252103ad899df0b73078e77f5da296ebc5
- SSDEEP 3072:u9qqL4GgHvqCeloCosN+KKl3Crqae4pv3CT1yYJFUO:u9qqLLgSCelovsN+PBgq6CT84b
- TLSH
  T157F31AD3BCD2C532F6B7487075648E31892DFC704B909997E7440AEB4A285E0FB6B762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  vendor/bin/alias.cmd
- Size 4KB
- SHA256 bf25628ff906e78accd74b0855e8e030b07017b8df92cbfd6529194f19ca027d
- MD5 63cee0b4fb12cd330ca3b65b384127cc
- SHA1 4ae7b23795285444cc087b4dadfd198b2ac53128
- SHA512 5779cf04c00f037c8bcdd90cb551a6111d62822872d488c8312f029c832162132e352a1cee478cbb4b0636a8b96bff356a9f5acb282f4ea8f03b90f22ec5b693
- SSDEEP 48:hpFhbeic/VzEooUtC7lvpFRdNW6HVvswVB5P7YnZzw2dyIdDyFyzhyvDdySWhyFA:hpqisoUtalvp1PrjYVDdW4DvU0
- TLSH
  T166817619303A927757FD6D736B2002A5FA14834B3762962E789E53AC87160D733F6F88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  vendor/bin/cexec.cmd
- Size 3KB
- SHA256 2dd031d7a3afe9fdd98359d9814e706f96fa7f6b04d3d5eff9ca397d036902ea
- MD5 ca4cdab544f34220cf87f55c25df9619
- SHA1 49313cc3b913d398e46e6fe42ce5aaee3b9489ac
- SHA512 c6c92dd92f57ee2732a5a98b583c553541f438839039246b066b3392c5c34ca9fc22d0030d85ad290e52fb786b0502fd7fb7473305db83e88290f8ce5aa681a9
- TLSH
  T15781931A7919A257F8B88B214D718072F31E23EF34405E4A343F52742B1A7C2B3FEA85
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  vendor/bin/cmder_diag.cmd
- Size 1KB
- SHA256 c2152bd63205dd3d7a8a7b0da189e7ca389efeb6aefdf522bc5dd474aa394175
- MD5 96d13c65026fb08e70a835500158844e
- SHA1 96d3a41f0c7e7e69abd4c27d995118a9968ec84a
- SHA512 33d30161f96c4e2136000b5da6810b56b5c0c187c53c8e0b49f0de91cb637732f4b818fe4f8aa9519b0d508515243c84051052a810fe6800e8b68bb305dbf055
- TLSH
  T1EB3161517C4EE16899A2E652FD3D4D1BFA43308B5DE57E24B40322340A405E6B3BCACC
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral7 behavioral8
- Target
  vendor/bin/cmder_diag.ps1
- Size 2KB
- SHA256 329ddbeb5dc0e529069721e0eb6737d1341112d394a208123dca1ed3ca68cbe7
- MD5 3f5a87a3efa8851552100f99d0c49f3d
- SHA1 b32487c5fcb7b6cad53a389747b12e356e8bcb41
- SHA512 379625b9e3354df95fa049e6bd60209a3f9cc9b51cadd9745aed95e8692b7bd99ba6dda9683ff12a6106d17af81b89d90de2d3fd8abe30abe81984b52f1dafea
- TLSH
  T16D41AA013F8606A7B073EF7CF2C5AC85DB690266442A29637464A5071FC9A2C93EE80D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  vendor/bin/cmder_diag.sh
- Size 1KB
- SHA256 d588472ce6259c53f7bd19fb06dfddddbbd9fac09c1415ca2d64cdb5bd44c88c
- MD5 43e8f8723e9d41d56f174e09722b1018
- SHA1 6915259947b4afc3b83f1fcfa14d186baf3d955a
- SHA512 53067d252398efce3e82ceaa5e60c281284a0ddc758512449b556bd2e084afd36347ddf4d4c17179b0c44998970b644db9a126da2af1b49ac7cf6226ebd6a22b
- TLSH
  T16C319051BE888D2E50B3E593BC998106F73A163B0C5D2F65E0A354766CBA1C0F5AD805
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  vendor/bin/cmder_shell.cmd
- Size 296B
- SHA256 c07f5d02e7d7d19488cbc3c5b9a6188532ae49ad4a6f00194fbabb4f8be4ac6f
- MD5 834d826e82ea557c378ff1e543fb47bb
- SHA1 00250c393f8a66f3db568c0dafb1d6dfe73c0a1a
- SHA512 67673fe621f9c07c2657cec630403fac0d88af6f961826d249bd2c672e6ed04da516a33a8d70cb2cb4a27d5457929890b0569394e1b514272d0832625f09f250
- TLSH
  T1B8E0C2027CCBFD530815BA57D2F08A29F02DC843016CF4773040C5BA1F1AB82E0DAA68
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  vendor/bin/excd.cmd
- Size 234B
- SHA256 cbaca4d2fd6e17ee12fd9c3efd50eb63cbe2975c335af9f8c1aef21c1596fb5d
- MD5 c17aa4903b34612b3f5e96a008005f32
- SHA1 8d1b936a235f27be8526cbfd7e780103fb6af415
- SHA512 2c7f951957bbe5f5ccf6f4d4d87ce3e7b6eb230190aed6df8cb8e75d1d41ff40107d7a2993ca86db2962a54c9ab28062e640881181bb799d6587097ec16f258b
- TLSH
  T17ED09281F41B28477421642B465629E9F7E58087F661FA3C26B2D8A4248B0150E8A1BA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  vendor/bin/timer.cmd
- Size 911B
- SHA256 294a35c6a614dbab18fcffa3b9a11f7110084fdf5c8b842ec1fdab8982ac5f65
- MD5 bfac137d692f5a6ba54c9ca7ffa8e9a6
- SHA1 45144d23a8fc7457940911c65b9f7feca38bc318
- SHA512 d8e6abf3800cce89dbea54b9a016c0f6b7395489b31a25b9a98b5e6a1921dba67aa65119edab5f2e58bbdc4bbc114131dd8dbcc80f883e0a50c29925a0fa74f5
- TLSH
  T17011AFE834C202690BF744F3E65E9FE1335BC5A4964AEBEC206CAA49B20CE7371015F1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  vendor/bin/vscode_init.cmd
- Size 749B
- SHA256 2e667a3397fff7cb8051701299a97d815bf35d3842b03cc3946910a631f6f30b
- MD5 f48ecb1419bbb0fd549738da15b04080
- SHA1 0d6d5122aec7794945f6ef8f9a27fda6be756d24
- SHA512 85ac0932ee174086106fb5a32d6750bc800985b6ddca4402c1c106e40a3abaf592e64f132331e6fa49b6325e42808aac4d8d5f1930c7fda6d9c5d8848740144d
- TLSH
  T1890128421C9781616C328232F76D05A4D00F8427567960E03D22C7CF4F74AA650FBBE7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  vendor/bin/vscode_init_args.cmd.default
- Size 1KB
- SHA256 6b4ad1ea667a5a8401108220d4f11bffdf2a43fed90bd41e905e5ad2b5942911
- MD5 fa0eeacf943861afb8e9f2af96c3a418
- SHA1 5c1f3d1cde8e8d6e2995f3ee5cf9e51bc3a480c5
- SHA512 2fc60d3382d025fa381253d47bdd0c7879935bf7967027aae6131c330e146052266494e395152901fe633d4750f10dc78732d925a8d4ba22ef0379a00e427ad1
- TLSH
  T19B216A00AD4FC8FF0CA6C6B9E27045C6E38964530DB6FBA8243788F86ECD65D706C096
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  vendor/clink-completions/chocolatey.lua
- Size 4KB
- SHA256 7ea444e8d24d2caafd2e1d7907d6b7eb9087c461e94f5c15f81dec0069717731
- MD5 17ce9f4b35201a3750ad6b53e2c8c8e8
- SHA1 4f20ffdebf9c6e9c8178b661aa7d30dbcdbfb784
- SHA512 80f6d6ed76c402534b8ce858a032f26a96dab0180ed1ee614023a6875b095c677ce312ab239c3909ee545312a69e8102fed2930931259b3e8161dbd29aadb885
- SSDEEP 96:O6hVyKI3FWEFZINrLTaizodL60LP0LKLOL6LK:NFLEL60LP0LKLOL6LK
- TLSH
  T175A178298105AE2319972ABFECCF26D2A315E1576C14784A32DE098C7FEF84F50B764D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  vendor/clink-completions/cmd_commands.lua
- Size 28KB
- SHA256 a2d350bf1c1c86a2e07c4166f8bbb2c6baaac9c34e38b4c553ca29526e04d084
- MD5 6d3982c2467328e4295491369cb6ac65
- SHA1 ff7f1843c351304861c6615fdf093db8d9d4302f
- SHA512 c2555db7b9a6173ae0a6117d334d1449e8b46d0313eb0abba547e0f22a9b29bfa36eac8b022b191fbcc1f8491f958ff6c83541dc2d1c78bc0bd16dd0f8863604
- SSDEEP 768:30U2xqRp+SbgaiOm3xQirio2kASICLIYih1sZqr6o/R57WgZMC7raBiql4KhLgiz:ZTSQrtZ57WCMCH4e7erprb
- TLSH
  T195D2235BAD4109735283D9D8CD9B4D02F2795113060891A5FAEC05982F393AFEAFF3AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  vendor/clink-completions/completions/bat.lua
- Size 6KB
- SHA256 6baf7fcbe43d90f2704f1fdfe098a317a26f7846e2f7e3251e36d768a19e22e8
- MD5 940f84a9a7d72d1a7211ad0fcd0ef767
- SHA1 b024ceee02e7c3d67f68c81112a1c778aad7ee14
- SHA512 32f22d100000de96d510d53554d2aac9cf53ae4872b75363edb7ae6c81d18a22e6b36ced56fae15328359eef15de0e7c2b4343fdca1785e4941f79a9c4db679c
- SSDEEP 192:AiAiyv9h/icvo/hjQ7f3uleFvBdpBXXNBOwBn8BS1BAyE5yAUckcwc0cQiF1iJ0j:AiAiUj/LAyeSi1Xj
- TLSH
  T111E14673AD01587063C1C8A8C55E0A27DA585533434485D5B9ED214C2FEA62EB7FEAFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  vendor/clink-completions/completions/delta.lua
- Size 6KB
- SHA256 11ac95e75b049eca9f1a352635486c797e6fe38b5ec6eb07dfa07bd6c99aa928
- MD5 37b5b0840190328eb14f6175138d7f9e
- SHA1 d269b17f9fbad94c5be1a1d40bc5dfa77b069a8e
- SHA512 e853941856c71b7919aae71158fc6a6ab3fc030f3093059b02e16b6e359ec69505d06a40b2ea27c976233564c3e1be96e5abed77e7804d27d4307c27a5068e92
- SSDEEP 192:FAHXsvXjhILcvV/hjQ7fY1vM9pB0yBKXNBDoNE5yAUckcwc0cQiF1iJ0A11Jgz5g:FAH+tIiLNQmSD+X8
- TLSH
  T172D16937AD0058B5A3C1C8A8D59F4927DA195133034485D4B9EC21483FAA26DF7FEAFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32