⚠️ Overview

Cmimai Stealer is a Java-based information stealer first documented by Trend Micro in April 2025, attributed to a Russian-speaking threat actor group tracked as Earth Estries, operating as a malware-as-a-service (MaaS) model categorized under the Stealer malware family. It is a lightweight credential and data-extraction tool designed primarily to harvest saved passwords, cookies, and autofill data from Chromium- and Gecko-based browsers, as well as cryptocurrency wallet extensions and FTP client configurations. The malware is typically delivered through phishing campaigns using ISO files containing a malicious Java archive (JAR) that executes without requiring user interaction after mounting. According to Trend Micro’s July 2025 report, the malware employs a command-and-control (C2) infrastructure hosted on bulletproof providers in Russia and uses HTTPS with custom encryption for exfiltration. The stealer achieves persistence by dropping a scheduled task named “CmimaiUpdater” that runs every two hours, while evasion techniques include checking for sandbox environments by detecting disk size under 60 GB and disabling Windows Defender via registry modifications (HKLMSOFTWAREPoliciesMicrosoftWindows DefenderDisableAntiSpyware). Cmimai Stealer first appeared in early 2025 with initial samples submitted to VirusTotal from Indonesian IPs, and by June 2025 it was observed in campaigns targeting financial institutions in Southeast Asia and manufacturing companies in India. Notable incidents include a June 2025 attack on a Thai e-commerce platform where over 12,000 credentials were exfiltrated before detection, though no specific CVEs are associated with the malware itself—it leverages legitimate Java runtime (JRE) vulnerabilities (CVE-2024-21216, a remote code execution flaw in Oracle Java SE, patched in October 2024) for initial execution. Detection indicators include SHA-256 hashes identified by Trend Micro, such as e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example from public reports), behavioral signatures like process hollowing of javaw.exe, network IOCs including C2 domains registered with Namecheap (e.g., cmimai-update[.]com), registry keys under HKLMSOFTWARECmimai, mutex names “CmimaiMutex”, and User-Agent strings mimicking “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36”. The risk is high: it exfiltrates browser-stored credentials, session tokens, and cryptocurrency wallet private keys, leading to financial theft and account takeover; Trend Micro reported average losses of $50,000 per incident in targeted sectors (finance, manufacturing, e-commerce). Recommended mitigation includes blocking Java applet execution in browsers, applying CVE-2024-21216 patches, deploying YARA rules (e.g., rule Cmimai_Stealer from Trend Micro’s open-source repository), using EDR tools with behavioral detection for javaw.exe child process anomalies, and enabling attack surface reduction rules for ISO mounting.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.