Cmstar Downloader: Lurid and Enfal's New Cousin - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 presents a technical analysis of the Cmstar downloader used in spear-phishing campaigns, describing an unusual method for manually building the Import Address Table via character/offset mappings, a hashing routine to detect AV processes (notably Kaspersky's avp.exe), encrypted configuration and shellcode that communicates with multiple C2 domains, registry persistence artifacts, and substantial infrastructure overlap tying Cmstar to Lurid/Enfal and Cmwhite; the report includes numerous IOCs (filenames, hashes, domains), delivery document metadata (MNKit and Tran Duy Linh toolkits), and a Yara rule for detection.