Cmstar Downloader: Lurid and Enfal's New Cousin
Summary: Unit 42 analyzed spear-phishing delivery documents that exploit CVE-2012-0158 to implant Cmstar, a custom downloader tied to the Lurid/Enfal family and named for the 'CM**' log string it writes to a DF64159.TMP debug file. Cmstar builds its import address table by matching API function name characters to offset values, decrypts a URL-only configuration and 752-byte shellcode that sends XOR-encrypted system data via HTTP POST to domains such as happy.launchtrue[.]com, most of which were originally registered with the email WANGMINGHUA6@GMAIL[.]COM.
Bottom line: Cmstar hashes running process names and compares them against three static values - one of which, 0x1E00AFA, matches Kaspersky's avp.exe - then reports the result to its C2 without changing behavior, a likely filter for skipping analysis systems and researchers. The same registrant email behind the C2 domains also appears on scam sites selling knock-off goods, leaving open whether the actors control it or buy domains through a reseller.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-0158
- Related
- When combining exploits for added effect goes wrong Cyber Risks ·