6f54ab8022c1f2bcc4064cd588bf1cfeca01f74e1f5e828fbb9e873c5266cf33

Sharing

Copy URL Twitter E-mail

General

Target
src (1).zip
Size 9.5MB
Sample260628-rertkahy5p
SHA256 6f54ab8022c1f2bcc4064cd588bf1cfeca01f74e1f5e828fbb9e873c5266cf33
MD5 793fbd7b1c2160c15486f2b51576125b
SHA1 289e9095166ad65f1f59c8fbf9ae5e5955fe1932
SHA512 9944e4d0f00ac6898f20ade9d047966fa8847824f41aa26ba9ec64a656b2c931b4542f9015936e3ed3691741622b25955c8dd71e25b5a4aa716482c13702ff90
SSDEEP 196608:VA0v2LvKMOZeB1GT1Otqvt3WHhhZta5kxSjrlWWMh3vaD4mErc/Scbxkw:VA0CKMqeB1GT1OwcHhdaqxcsfaD4G/So
TLSH
T179A6121CA700BF30DAD668F926D35217AF68F5C111865E121F629BE02C4E4A72FFA35D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  claude-code-main/utils/secureStorage/macOsKeychainStorage.ts
- Size 8KB
- SHA256 178df791a6b7c6ebccdd6f02c47319089b4245b47c79d7d5b644e90720fa2244
- MD5 18ddeb0852a6608b7644dc5271c9e360
- SHA1 9797969e5604260eefc463d61b8190042f125f60
- SHA512 3bf6c12de52e2276aea09805e6ba04f5439214c5405f250a1966b7a49e8edb9953abf05a8fcb772b39c4fda1e195f908af95c14760f1a9cb81785075e6fdfe9d
- SSDEEP 192:08RBZb6ATonANmQuv+SZEXDQ+WN7PqFw32w1bhg:RB5oduDQtZD2Wg
- TLSH
  T1190284D156B611390A42A03F9F4F70517264A403B72EE55DBD8F4324BF0E86CE2B5EEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  claude-code-main/utils/secureStorage/plainTextStorage.ts
- Size 2KB
- SHA256 5be4533db9ed637c7c3ed6d521554906ec0601ef66ed46ba74f0d8becaec2bf7
- MD5 a1c0ae2553bab92e2906c09e43eee886
- SHA1 da2ecdf07fd13487cedc3268cb135cfd99403503
- SHA512 4d8eaa6613e334dbbfaafb35fa24369038f4d7b9371733244678eafe5d82e979db90318b0326999b0daf87fa415fbb740c67dd517093dcad28a989deb3d980e4
- TLSH
  T15441B95339F916244B13652CE61EB010743A8183771EDDA8BE2E63187F4E52893F22DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  claude-code-main/utils/sequential.ts
- Size 1KB
- SHA256 7f4dc5c66c0314028dfeeec72402afc467be81373a228494af0238f61b214d3c
- MD5 300a6053e889393218281c96ae4892b4
- SHA1 877d8c6c557c496076ef84d92ea2986ff46ebb5b
- SHA512 f7224dc0fafa6e03a3b893f13c6c10c2b4250c318e29cb3b1037b195b6618a437568a077ce28ae5162e0b4218c4f5d40e796768610666b12e65f81dfb6a76b7a
- TLSH
  T1BE31F21231D93231834B7438654F6A9EB739C65B334A5670786ED2243F42074E6A7E69
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  claude-code-main/utils/sessionActivity.ts
- Size 3KB
- SHA256 87aad677fc8c687bc36996d42d51c4e8ff2bd4a9d8c1064e21dc33d4b8947935
- MD5 6bd638bca96865370758a69cc53d7ed5
- SHA1 c6b41ed47d849db3ac1d02c4717cd5a2cc4dc3a8
- SHA512 ed19df8d767ee20f21e75dfdc21be9adc18da35c53a5ac901662257789c013721f4d3630bc2abf75e1bc6b3a032e17c3b13ebe236168618fec5631da06c5a0d6
- TLSH
  T1A681624E73BD22770BB3C3D1612992C677128247231908B0BB8F4BB55F9276942B1E6B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  claude-code-main/utils/sessionEnvironment.ts
- Size 4KB
- SHA256 42771f2c18bac3421865a742e45972463f85f33db5c897814f06bf7aa106a000
- MD5 0cd7fa93230da4523b19ded741de2183
- SHA1 ca260e09d4b4d6c8d98b88e0773564dc54ec4fc0
- SHA512 f0cc565394f36d41753959552804233155d82aa3b7d5c75febbfc3f375f79f0880c8b9c23a741e742c41933047e8abf600292cca0635c98eaf8be08f7b24abab
- SSDEEP 96:LM34Bb3UgvKwKrSPKS8fPyOjKD3gQbDyfoYOz/Kfeea6f8g3Xke:mSkW35RVreaTbe
- TLSH
  T189A146293EB941300782B095947FD011237AC3273A34BDD87AAD97247F45D388AE67F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  claude-code-main/utils/sessionIngressAuth.ts
- Size 4KB
- SHA256 d1b4b95fc96bf83e4080d7a2d217313960512fa9d55da6dd8e468d3746e51a37
- MD5 c32080fd96d395e2a1066562a8197292
- SHA1 1cba762da1262e52fed9cfff271001101732279f
- SHA512 64d35e17972f6e3b8a601fdd9e3f2711f6cc650ead83fade5fb08483ff354f6478ee7ba1c61c0e0ee95bd325344d1d8e76ded941854f333be9ab6c5c638d126a
- SSDEEP 96:WVP8yKPqSPR7rUU+kSXsOMnT7ChVU+rBv8C559XreOvR8eGIxQ9XZgAR5ByC2g:ZfRSk06nfChhrB0yXvR7xQFh5k7g
- TLSH
  T166A167146A94602187C1D8E58F6C5C33276191073739EA94B6ECC3C06F44AA6DE77EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  claude-code-main/utils/sessionStart.ts
- Size 7KB
- SHA256 e3c53cb0174ff70d4c479895a71db36d53a8cf321e497eae3c6708a7ff452968
- MD5 3aa64d74ea0793b223d8c3b29913c5f4
- SHA1 f6687e1bd7b9cc8f55e3f5bdd9902dac8325100c
- SHA512 bd7de44b4ec1d67bebf614fa961c778006d7d97c832214c8e3f4f8325ba587bbe966e87b86fc33dbdbf887bd3bf4be523fea99b8784daf3a80a23ffb88505951
- SSDEEP 192:Sl7YjDosQXbN+cEoMON/cBivFSGWiWKIGNxBURE0:Sl7Y+5NlcBivF1D6N
- TLSH
  T1AEF1841B55B8482B06724064769D304257F641432BA4F9B4FB8D93BAAFC606D58B3BC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  claude-code-main/utils/sessionStorage.ts
- Size 176KB
- SHA256 8a123ebce1ee72b9081d34b8f3697e5fcc9c7576df5b98e4206bb28414134412
- MD5 8afaa1b28ada9d9886ee69b4d9112f38
- SHA1 2076d3277c9690dc79d1199c4f3a2b7746d983a3
- SHA512 67a7247e103a63d8f44cd88fdbecbf0add1be84391018d93bd7c207d878a6550eb2c9874956279dc23c00c00cd175b5376b1ada74ee6c0759525b4a64bf31908
- SSDEEP 1536:4eNq6zrjAOTEVYvTkFe3+YnQSibBckRYk/IEsSMZjO4JAbA9mZcuFIbRLhV:4eXsOxTkd7PbB6k/GSMZjOaA0vRhV
- TLSH
  T15F04C4507CB806358BC3A2757BAF7112A334C0133624B965F9DD4258AF8E5AD93B2FE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  claude-code-main/utils/sessionStoragePortable.ts
- Size 24KB
- SHA256 c9470c555fe9e621d4c47cea89261393b124ab54246353968be88d272f57945f
- MD5 b0c30cf2a468c2ba4aa6f16a8ff64298
- SHA1 c9c30e949013f070db2c433fc0d97579f2e397df
- SHA512 012bfebf2ce986c4c98a51ab1afc0cb82b8f8161740408b09102e5f553c95610af5eddb185495ec3cf5273c5e484b21a64da6aa4ba94a640ad2bd300119982c9
- SSDEEP 768:5QrtayJwb7+eGdZa/R1oNBDyxKyhnX//0:5Qr0y2byeGdA+vyxLhX/s
- TLSH
  T1CCB2A5095CB010728753E1751A5B2945E727E227373829BAF9DD83003F0A57986FEFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  claude-code-main/utils/sessionTitle.ts
- Size 4KB
- SHA256 5729f24eadf5562d0868a8a8393a51bb999568769274626d84016be87553f6fe
- MD5 319bc05c0f7a618e63533b46d481c446
- SHA1 8a7bde098e15a8eccb5f8c4ccda6c52dd1c1b271
- SHA512 6142620e5640906b09acc6a74144b3e79c05b5f9d5fa81bb1eadeee36723c6463d873425f2d450aaa1834eb92401473686967ba00b8566b90da4b41a7498f9e6
- SSDEEP 96:Ugj/McTLVz2kEzYdPztturNtq3JYUKa7VK0mkohBYKr5OJqmGG7x1L0Dy9sZ:fj/hL42ya7QkoH5OJqtG7xIyGZ
- TLSH
  T113A1A56469B11036474791952D8FB0D1B330814337F4ABA0FABDC264AFCA999D1B3FDA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  claude-code-main/utils/settings/applySettingsChange.ts
- Size 3KB
- SHA256 efa30235530ca7be96197234fda3dd9ccaa0d159a4e1802f3e95854c60b74988
- MD5 8a1fbcf3028be190ebd79b35cca5a4c6
- SHA1 47cb2339e5374ab2644304bd37676811659db93e
- SHA512 9d5aa5ed0f3558f672c6819d150989d93df90c7f19c8eb30dd23b4a36389e275418c1f4cac80cd62afa08bb8a4782537aba021880c7301c2379d4c05118a3a43
- TLSH
  T1EC717367BD58013D9B4290FCFA3DA2020B31609B7750947CB2BE0318AFCA5FC91ACAD4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  claude-code-main/utils/settings/changeDetector.ts
- Size 16KB
- SHA256 0d7f3c77e6481a30690910bf36c03df780a295c55361852061730dd5b35ba5d2
- MD5 e322a8b4a1c99f29af1880cce4082422
- SHA1 9b46e1f91f5efa40c1f00f979c33fdf030f9141b
- SHA512 a3972b70e45281e8febf660b056b98b00bda2c714fa41ad07fcfebb22ebd6b00b36220bc7ba665798c6b7b2da2559d537dc5b731947b62f81484f0a8c7c325fd
- SSDEEP 384:B3dS0VAS05ijyC4eHeRIxtwHBAcfu8/AkC3ttLc:9dS0VAS0eyC4e+RIMhAIC9tLc
- TLSH
  T16072C67333A900264FC25171D75D63622315C5AF223A68BDBA6F43502F5A1AC83F9FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  claude-code-main/utils/settings/mdm/constants.ts
- Size 2KB
- SHA256 9d5a3693aca5fe87e5751ef264f4709fca4a2ef87e03c217c256f442a21350cb
- MD5 320f34844e69f6b7f8d7a98bac4aff26
- SHA1 55587c093f7767796731b9a3716aa9f189df64a5
- SHA512 9e035de44420d9ff5cea8a6d9d94176601e942cef43a91191e69b111715716d97dc1e5232d8a5afc7459c641bd977e240e1d72a3fc16b96d7a02694d8a52b560
- TLSH
  T1C85196671225014A43F01BB3AB2F928F2377F0C337746569B59D42690F065D6883ABD7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  claude-code-main/utils/settings/permissionValidation.ts
- Size 8KB
- SHA256 7a0bde608235359c00dac1e717e870d7e858f75313d3698d9d13531896ed255f
- MD5 ef1f7fbd0c6b59ea489f03a032075b4f
- SHA1 6103664795a58c4a20fb222d9803fd94e957c666
- SHA512 40b73da32bc695d510482ea947e5da001799367408decd6ebf8940dfdbd05bf8ec9a451c63385e1eb086dd96c5e4564eb2d633b1be050bcf760c2493a2e8fd9b
- SSDEEP 192:wfyXxmDXgGiQMDT7Ixne5fGMHW9h22+56YCwLbhYM53y1Z:wfyXxusDoMgMHW9h2BpPR5c
- TLSH
  T15F029664E5E920350E5152B6969EA002B3ACC503AA287D75F99F03243F8E57DD0F77E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  claude-code-main/utils/settings/settings.ts
- Size 31KB
- SHA256 214e314d6424ee0e38cccae5fe88d5e6893e5932afa26d7b8711a441146dbf4f
- MD5 447ef8f6437ee02434aeca83fecea18e
- SHA1 6083f8381761d00d1ca4d3eca2ef2747fb73af9a
- SHA512 342a973b7c027118fcc7b660594e82f3629c556b1e31f50a81b84e0b28213deb1eea5b02a02117106ccdf49099fec1a9c278b57f84f591f5ee0078b2cd0fbb91
- SSDEEP 384:U3c5UI1D6PLApx/TOjnDohGlaebgRXsI1vt3744zfMr21tNzxzzNcaGDueRTSPS0:UC1hbFvNdpy21
- TLSH
  T1A9E2955B2690513E8A4361B6CE0F9312B33494133538E9BCB97E86343F955E85BF6EC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  claude-code-main/utils/settings/validation.ts
- Size 7KB
- SHA256 f616156e6c940e2c1407a603ef9543020705ea3f65ab3195e59fed8b43f7c6f6
- MD5 21964c6463d8dc650b2ec49dba7b7a54
- SHA1 776a008a1df94fe3f18a8b5f5e4029020c5c6080
- SHA512 169ad8b23112e4702dbefc50a1813d8cd57a62060bb544f374f4f5eab9f66d195ed265a6df4e4375055f0a33abdf09c9a2e2be43cba8345c13756e35fe3c51c6
- SSDEEP 192:RvPeRuVRxrQKccMfZi3EY3wr/t3oW9yrBC0GTv7S1qAlxOXaeUlWx2jE8:RnF1cc0Qt45/pd7Zaepct
- TLSH
  T19DF124496CD101224E5250F979AEB041A6E4819B132479F4FDDD46B03F8CAB8E7F7BD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32