CmdID

CmdID / Files

opera.exe

Opera Internet Browser file version info

Program on Windows 4 known copies with hashes 27 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real opera.exe?

file version info and known copies
Installed inC:\Program Files\Opera\
C:\Program Files\Opera\70.0.3728.106\
C:\program files\Opera\70.0.3728.133\
Signed byOpera Software AS
ProductOpera Internet Browser, Opera Software
DescriptionOpera Internet Browser

4 known copies

81.0.4196.31 · C:\Program Files\Opera\opera.exe · signed by Opera Software AS

8e7df6927a8cc697945fafc77cda348d4a6811c519311e2a5f56ec26b5e4a60b

71.0.3770.171 · C:\Program Files\Opera\71.0.3770.171\opera.exe · signed by Opera Software AS

b1b08564eda71d5442bd43e8260878d2971cc42a276a196b825cdf1439da7fc3

70.0.3728.133 · C:\program files\Opera\70.0.3728.133\opera.exe · signed by Opera Software AS

34c64630d6c37c370b54bc166bb7986bd74b3c619fbdbdf969ae9560bb6428ee

70.0.3728.106 · C:\Program Files\Opera\70.0.3728.106\opera.exe · signed by Opera Software AS

e8cbf7487b32541cac4b87d870c13320a3d0d954c40f4777c397b960be690174

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name opera.exe
highChromium Browser Headless Execution To Mockbin Like SiteX__Junior (Nextron Systems)
highFile Download with Headless BrowserSreeman, Florian Roth (Nextron Systems)
highMstsc.EXE Execution From Uncommon ParentNasreddine Bencherchali (Nextron Systems)
highSuspicious Chromium Browser Instance Executed With Custom ExtensionAedan Russell, frack113, X__Junior (Nextron Systems)
mediumChromium Browser Instance Executed With Custom ExtensionAedan Russell, frack113, X__Junior (Nextron Systems)
mediumFile Download From Browser Process Via Inline URLFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
mediumPotential Suspicious Browser Launch From Document Reader ProcessJoseph Kamau
lowBrowser Execution In Headless ModeNasreddine Bencherchali (Nextron Systems)
lowHTML File Opened From Download FolderJoseph Kamau

Sigma names opera.exe in 27 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.