cfb3accdf0f90d4e56a51f6b82eeaf96b6c9f8f7cd9f58e5c996ff1f515d19c6

Sharing

Copy URL Twitter E-mail

General

Target
cmder_mini.zip
Size 12.2MB
Sample261110-pl98dattey
SHA256 cfb3accdf0f90d4e56a51f6b82eeaf96b6c9f8f7cd9f58e5c996ff1f515d19c6
MD5 70d746930c7a4450c87e45123cb1a6c4
SHA1 0d18ace9916667a31b1a25546a7c438c499c5e50
SHA512 cbd50898025d723a1e03b16eef1807ac8d98df65e9deb8edde411008c53fd05589be26398629a93a44bc9d2e383b8586191422dbf61fd58df4b8d4bfe6850b57
SSDEEP 196608:gDtoBEfB8h9SJuwvEaPEngM4+6NKiFDcdjRCnKwpFv4Ucjr2C+5YvBQJVFtuv1SX:gKBj60ngMOtDK447id
TLSH
T1A4D633568A065504FF022E3B8F4FE68CE7E140D7763AF28B3DB93555190BA802FDE256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Cmder.exe
- Size 161KB
- SHA256 94fdb85080488ea5e18e202b44259a229b0198facfa5cefc8902de0184cae817
- MD5 7241c7e99a056a3a01bc5610e749a435
- SHA1 18464d67788b02a34e27ba8c3f797e1abb196090
- SHA512 966548644e9c3abe5b4cbd09e743f41d13f3df2e29d1d4f50714aaa6c81248d718a9b254df91302c768b99102cb60f252103ad899df0b73078e77f5da296ebc5
- SSDEEP 3072:u9qqL4GgHvqCeloCosN+KKl3Crqae4pv3CT1yYJFUO:u9qqLLgSCelovsN+PBgq6CT84b
- TLSH
  T157F31AD3BCD2C532F6B7487075648E31892DFC704B909997E7440AEB4A285E0FB6B762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  vendor/bin/alias.cmd
- Size 4KB
- SHA256 bf25628ff906e78accd74b0855e8e030b07017b8df92cbfd6529194f19ca027d
- MD5 63cee0b4fb12cd330ca3b65b384127cc
- SHA1 4ae7b23795285444cc087b4dadfd198b2ac53128
- SHA512 5779cf04c00f037c8bcdd90cb551a6111d62822872d488c8312f029c832162132e352a1cee478cbb4b0636a8b96bff356a9f5acb282f4ea8f03b90f22ec5b693
- SSDEEP 48:hpFhbeic/VzEooUtC7lvpFRdNW6HVvswVB5P7YnZzw2dyIdDyFyzhyvDdySWhyFA:hpqisoUtalvp1PrjYVDdW4DvU0
- TLSH
  T166817619303A927757FD6D736B2002A5FA14834B3762962E789E53AC87160D733F6F88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  vendor/bin/cexec.cmd
- Size 3KB
- SHA256 2dd031d7a3afe9fdd98359d9814e706f96fa7f6b04d3d5eff9ca397d036902ea
- MD5 ca4cdab544f34220cf87f55c25df9619
- SHA1 49313cc3b913d398e46e6fe42ce5aaee3b9489ac
- SHA512 c6c92dd92f57ee2732a5a98b583c553541f438839039246b066b3392c5c34ca9fc22d0030d85ad290e52fb786b0502fd7fb7473305db83e88290f8ce5aa681a9
- TLSH
  T15781931A7919A257F8B88B214D718072F31E23EF34405E4A343F52742B1A7C2B3FEA85
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  vendor/bin/cmder_diag.cmd
- Size 1KB
- SHA256 c2152bd63205dd3d7a8a7b0da189e7ca389efeb6aefdf522bc5dd474aa394175
- MD5 96d13c65026fb08e70a835500158844e
- SHA1 96d3a41f0c7e7e69abd4c27d995118a9968ec84a
- SHA512 33d30161f96c4e2136000b5da6810b56b5c0c187c53c8e0b49f0de91cb637732f4b818fe4f8aa9519b0d508515243c84051052a810fe6800e8b68bb305dbf055
- TLSH
  T1EB3161517C4EE16899A2E652FD3D4D1BFA43308B5DE57E24B40322340A405E6B3BCACC
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral7 behavioral8
- Target
  vendor/bin/cmder_diag.ps1
- Size 2KB
- SHA256 329ddbeb5dc0e529069721e0eb6737d1341112d394a208123dca1ed3ca68cbe7
- MD5 3f5a87a3efa8851552100f99d0c49f3d
- SHA1 b32487c5fcb7b6cad53a389747b12e356e8bcb41
- SHA512 379625b9e3354df95fa049e6bd60209a3f9cc9b51cadd9745aed95e8692b7bd99ba6dda9683ff12a6106d17af81b89d90de2d3fd8abe30abe81984b52f1dafea
- TLSH
  T16D41AA013F8606A7B073EF7CF2C5AC85DB690266442A29637464A5071FC9A2C93EE80D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  vendor/bin/cmder_diag.sh
- Size 1KB
- SHA256 d588472ce6259c53f7bd19fb06dfddddbbd9fac09c1415ca2d64cdb5bd44c88c
- MD5 43e8f8723e9d41d56f174e09722b1018
- SHA1 6915259947b4afc3b83f1fcfa14d186baf3d955a
- SHA512 53067d252398efce3e82ceaa5e60c281284a0ddc758512449b556bd2e084afd36347ddf4d4c17179b0c44998970b644db9a126da2af1b49ac7cf6226ebd6a22b
- TLSH
  T16C319051BE888D2E50B3E593BC998106F73A163B0C5D2F65E0A354766CBA1C0F5AD805
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  vendor/bin/cmder_shell.cmd
- Size 296B
- SHA256 c07f5d02e7d7d19488cbc3c5b9a6188532ae49ad4a6f00194fbabb4f8be4ac6f
- MD5 834d826e82ea557c378ff1e543fb47bb
- SHA1 00250c393f8a66f3db568c0dafb1d6dfe73c0a1a
- SHA512 67673fe621f9c07c2657cec630403fac0d88af6f961826d249bd2c672e6ed04da516a33a8d70cb2cb4a27d5457929890b0569394e1b514272d0832625f09f250
- TLSH
  T1B8E0C2027CCBFD530815BA57D2F08A29F02DC843016CF4773040C5BA1F1AB82E0DAA68
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  vendor/bin/excd.cmd
- Size 234B
- SHA256 cbaca4d2fd6e17ee12fd9c3efd50eb63cbe2975c335af9f8c1aef21c1596fb5d
- MD5 c17aa4903b34612b3f5e96a008005f32
- SHA1 8d1b936a235f27be8526cbfd7e780103fb6af415
- SHA512 2c7f951957bbe5f5ccf6f4d4d87ce3e7b6eb230190aed6df8cb8e75d1d41ff40107d7a2993ca86db2962a54c9ab28062e640881181bb799d6587097ec16f258b
- TLSH
  T17ED09281F41B28477421642B465629E9F7E58087F661FA3C26B2D8A4248B0150E8A1BA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  vendor/bin/timer.cmd
- Size 911B
- SHA256 294a35c6a614dbab18fcffa3b9a11f7110084fdf5c8b842ec1fdab8982ac5f65
- MD5 bfac137d692f5a6ba54c9ca7ffa8e9a6
- SHA1 45144d23a8fc7457940911c65b9f7feca38bc318
- SHA512 d8e6abf3800cce89dbea54b9a016c0f6b7395489b31a25b9a98b5e6a1921dba67aa65119edab5f2e58bbdc4bbc114131dd8dbcc80f883e0a50c29925a0fa74f5
- TLSH
  T17011AFE834C202690BF744F3E65E9FE1335BC5A4964AEBEC206CAA49B20CE7371015F1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  vendor/bin/vscode_init.cmd
- Size 749B
- SHA256 2e667a3397fff7cb8051701299a97d815bf35d3842b03cc3946910a631f6f30b
- MD5 f48ecb1419bbb0fd549738da15b04080
- SHA1 0d6d5122aec7794945f6ef8f9a27fda6be756d24
- SHA512 85ac0932ee174086106fb5a32d6750bc800985b6ddca4402c1c106e40a3abaf592e64f132331e6fa49b6325e42808aac4d8d5f1930c7fda6d9c5d8848740144d
- TLSH
  T1890128421C9781616C328232F76D05A4D00F8427567960E03D22C7CF4F74AA650FBBE7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  vendor/bin/vscode_init_args.cmd.default
- Size 1KB
- SHA256 6b4ad1ea667a5a8401108220d4f11bffdf2a43fed90bd41e905e5ad2b5942911
- MD5 fa0eeacf943861afb8e9f2af96c3a418
- SHA1 5c1f3d1cde8e8d6e2995f3ee5cf9e51bc3a480c5
- SHA512 2fc60d3382d025fa381253d47bdd0c7879935bf7967027aae6131c330e146052266494e395152901fe633d4750f10dc78732d925a8d4ba22ef0379a00e427ad1
- TLSH
  T19B216A00AD4FC8FF0CA6C6B9E27045C6E38964530DB6FBA8243788F86ECD65D706C096
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  vendor/clink-completions/chocolatey.lua
- Size 4KB
- SHA256 7ea444e8d24d2caafd2e1d7907d6b7eb9087c461e94f5c15f81dec0069717731
- MD5 17ce9f4b35201a3750ad6b53e2c8c8e8
- SHA1 4f20ffdebf9c6e9c8178b661aa7d30dbcdbfb784
- SHA512 80f6d6ed76c402534b8ce858a032f26a96dab0180ed1ee614023a6875b095c677ce312ab239c3909ee545312a69e8102fed2930931259b3e8161dbd29aadb885
- SSDEEP 96:O6hVyKI3FWEFZINrLTaizodL60LP0LKLOL6LK:NFLEL60LP0LKLOL6LK
- TLSH
  T175A178298105AE2319972ABFECCF26D2A315E1576C14784A32DE098C7FEF84F50B764D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  vendor/clink-completions/cmd_commands.lua
- Size 28KB
- SHA256 a2d350bf1c1c86a2e07c4166f8bbb2c6baaac9c34e38b4c553ca29526e04d084
- MD5 6d3982c2467328e4295491369cb6ac65
- SHA1 ff7f1843c351304861c6615fdf093db8d9d4302f
- SHA512 c2555db7b9a6173ae0a6117d334d1449e8b46d0313eb0abba547e0f22a9b29bfa36eac8b022b191fbcc1f8491f958ff6c83541dc2d1c78bc0bd16dd0f8863604
- SSDEEP 768:30U2xqRp+SbgaiOm3xQirio2kASICLIYih1sZqr6o/R57WgZMC7raBiql4KhLgiz:ZTSQrtZ57WCMCH4e7erprb
- TLSH
  T195D2235BAD4109735283D9D8CD9B4D02F2795113060891A5FAEC05982F393AFEAFF3AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  vendor/clink-completions/completions/bat.lua
- Size 6KB
- SHA256 6baf7fcbe43d90f2704f1fdfe098a317a26f7846e2f7e3251e36d768a19e22e8
- MD5 940f84a9a7d72d1a7211ad0fcd0ef767
- SHA1 b024ceee02e7c3d67f68c81112a1c778aad7ee14
- SHA512 32f22d100000de96d510d53554d2aac9cf53ae4872b75363edb7ae6c81d18a22e6b36ced56fae15328359eef15de0e7c2b4343fdca1785e4941f79a9c4db679c
- SSDEEP 192:AiAiyv9h/icvo/hjQ7f3uleFvBdpBXXNBOwBn8BS1BAyE5yAUckcwc0cQiF1iJ0j:AiAiUj/LAyeSi1Xj
- TLSH
  T111E14673AD01587063C1C8A8C55E0A27DA585533434485D5B9ED214C2FEA62EB7FEAFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  vendor/clink-completions/completions/delta.lua
- Size 6KB
- SHA256 11ac95e75b049eca9f1a352635486c797e6fe38b5ec6eb07dfa07bd6c99aa928
- MD5 37b5b0840190328eb14f6175138d7f9e
- SHA1 d269b17f9fbad94c5be1a1d40bc5dfa77b069a8e
- SHA512 e853941856c71b7919aae71158fc6a6ab3fc030f3093059b02e16b6e359ec69505d06a40b2ea27c976233564c3e1be96e5abed77e7804d27d4307c27a5068e92
- SSDEEP 192:FAHXsvXjhILcvV/hjQ7fY1vM9pB0yBKXNBDoNE5yAUckcwc0cQiF1iJ0A11Jgz5g:FAH+tIiLNQmSD+X8
- TLSH
  T172D16937AD0058B5A3C1C8A8D59F4927DA195133034485D4B9EC21483FAA26DF7FEAFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Reads user/profile data of web browsers

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32