1c37778dc292edb101551b34348e71c41954ade4696b00f6f75ada52ef3ba30e

Sharing

Copy URL Twitter E-mail

General

Target
claude-code-main.zip
Size 10.9MB
Sample260701-vjeataay2m
SHA256 1c37778dc292edb101551b34348e71c41954ade4696b00f6f75ada52ef3ba30e
MD5 54b25a593b70bb427ccab85e622e9e2a
SHA1 6632cf51b9c8de5ca90b1237589d6a12382bfe15
SHA512 feaa22dac884f422393dac259cb479837781dfa8f829d38a92283ae115540baaaa710baff901622af8780e0627841be65f8882f9176b0513d40fd88587f18b43
SSDEEP 196608:pUnbSwdBCItiUgnwL1BrAnZ+PQ6ZKnKl1VtkGidPNKo4l4z2ZNJXa:mbln3tlMwLvAnnm2MD2GyKo4rNRa
TLSH
T1A6C63321661EDE50C5A6307669C3164B27FEF6E030D989281BD35BE8450F4BFB9312AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  claude-code-main/.devcontainer/init-firewall.sh
- Size 4KB
- SHA256 711bc435138f14778e753706c4985145bb196045830807131841057d890ecfda
- MD5 e6acdf1c7c334bfc73c5822ae735d654
- SHA1 5bb29f11be5a7242bc43ee84aa1bb6bcb5aae5bf
- SHA512 a7633ba74da4b46ab600d2bfcb6391fe99a87164024111dc5f0c3879a08b43b9c28d34e96b601ba75942450cb9a0b6403d20cee0dbbab2a5ccad604252f646f6
- SSDEEP 96:unIh8k/PGY/3WlGl1gnWCnFnPQVgycXhc5D+wz9i/Gzxr+:unIhl/Ry1VQYX2pnie9q
- TLSH
  T1AD917093B654A8F0B5EEE17078C632567D1150DF49237838B45FC1682F59AB822FCBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Flushes firewall rules
  Flushes/ disables firewall rules inside the Linux kernel.
  defense_evasion
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  claude-code-main/.github/workflows/lock-closed-issues.yml
- Size 2KB
- SHA256 f458c35bea52880fe25edb6ff6b9866484a4f654b5efa594c15f5474431e4822
- MD5 92876366caf175ce1f4a123261bd6ffb
- SHA1 a56d8d4fd1b2843f8ecf417bce8f9559c8fd3732
- SHA512 81df58695731536c6083fc2a1786a9e520220469d88d3eb5dd0aa43afc36af03be6eaf07e6105d56a190d8bb91f5e6be04864648ecdae28e0a2b01f18296fa6a
- TLSH
  T15551CD5D8C7549221673D1B59F735180612165ABAB00F8AE3B9CD3180FCF59CAAF32DE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  claude-code-main/.github/workflows/remove-autoclose-label.yml
- Size 1KB
- SHA256 750e708f9127b04f1378558c5278faabc55209b9605ad1b668ea1e5044827f59
- MD5 d5c64b7283b3401cf16e460088b5efd5
- SHA1 a543f85723be307a4e251a1af4384282f425da58
- SHA512 0963f16cc5804c113010ce420fb047c83bd1fce5c8045f780e67f776d0079d8757548f76cb6aeb530d857181787436def85926255e4bdc18595ce3c9c03144a7
- TLSH
  T11D319A4AC99216244AE3253A9A6B4041F015D55BC000FCEEB4DF5A594FC83ECB5C23E6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  claude-code-main/Script/run_devcontainer_claude_code.ps1
- Size 5KB
- SHA256 d1571795e2fa70445ca9cf093117348bff34ccd4ae7ec4c2e0ad4d8af3e7c0e0
- MD5 1265678ab934d704f0d361e0af77086f
- SHA1 b4eabef855e1d7c533b0c488776fdcfab98d043e
- SHA512 7d5f97bbbd89f19bc220e04a629701ce0bbbd16f6ccff1961411c82802b6eeb5161c236acf3ab31b11bc6e989bb89007df998a17de9c63a48ddedb2fa18a3692
- SSDEEP 96:kk/xHfaQVy3yVKXx/0ymncL85sdeeDBC8neIq/ctHRiZ1gNI/7C:THTVy3y8Xx/+cL85sYeDwO0/axw1iI/u
- TLSH
  T171B12617AF940677BAE0850F345AD2095B97839F83482C5178BCA500EFDA15DC6E3BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  claude-code-main/examples/gateway/gcp/setup.sh
- Size 29KB
- SHA256 a0748540cfdb48102e1ef1d42601dc22b00c522a5ca2ef01a6424aa012dbbeff
- MD5 0b9a91ccd41358abbe1721f49b6ac89f
- SHA1 ede1d4fc2b9087f4a879ee0ff00f6b9a4384751e
- SHA512 9c6bf25980496b5a7a38ecf70fd93df5103332fba3885dcab82e9b0d40a0535bdc8d6218df2dd39f42e691282c45e3e646e6a11c2efdf9d778356c025db80c01
- SSDEEP 768:hN2C1eENsDRpeaImWoSWBFu0uub+OGuC0fmN:hNvsD+injg
- TLSH
  T1F1D2B823FF84D235968DC063F5CB6206F306804ECA946C59B6EEC2541765A3C877EAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  claude-code-main/examples/gateway/gcp/terraform/README.md
- Size 7KB
- SHA256 e580550ce87145ae65a1960c4c4f077bd5bbace1b8bed66b9929a34f928c1729
- MD5 d3ca85fc11358e20c009041026d109e8
- SHA1 fb4f09cb114b04e2a1c43ddfdd1b235448e41fed
- SHA512 d9af0ed3718b9a689738b694c1d60501487651f8adedf8e90c22f2fd55f618856fd29953fceeb45e46c9e81c7199624ae582eb7b8f423257a02f3b413ec6a96f
- SSDEEP 192:ehUBl0UPYBRY/lOJz2znaFsAkzj4k3DaSuufsYyYC:F4UPYBRYwJ29u+Y
- TLSH
  T189F11A2713D4A233397DA4E6FC8A52C2AB52801C03BB381E57FD8198609773D467EAF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  claude-code-main/examples/hooks/bash_command_validator_example.py
- Size 2KB
- SHA256 0d7a9468405bb614ebddfb56037217cd9282a8045ea87a42cf6ff4099a61820d
- MD5 ca155b85f5b89d6a2ae8b99e74c3b916
- SHA1 b40e5f4ae07f34f5b167abb4f7b9bac9d29743f3
- SHA512 b56ab8520593a4c2cb0e95216009a34a7faf160fcd9fda76d54e937fed79d9f414a12ce188c0f6894145e25dad5faa1de158d22f291081e58ae00a61ff1385de
- TLSH
  T1ED41640BC5B82C21298320BE3AC89451D28A954F41412D077EEDDB645F8D7BBC3B97BC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  claude-code-main/plugins/explanatory-output-style/hooks-handlers/session-start.sh
- Size 1KB
- SHA256 58efe97b7f5ccd384e0ee12a2f3dd2e75a38df35841a1b27ea6d9eb833c28912
- MD5 7d5691a61af8e42e13b19f694a5a596e
- SHA1 5784907d1b8cfde45cea0651a9d56764538d7c66
- SHA512 b2dba04a176db3349b8a6586e78c70fedc63107607e6605add7182d76177dcdd0787a120c09231220d4a5d4d7720a7d618dbd72097c6b97fcead8233c6085080
- TLSH
  T18C31107AA2D003663293C1CF23CE22C9963D791C3B804940845A32B453DD519C7237FE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  claude-code-main/plugins/hookify/core/config_loader.py
- Size 9KB
- SHA256 9f1d083cc43883323ddf00747e7696a4fd9d478ddd63f5b43038657da8516e56
- MD5 4b4024bd183e39dbadab43e725205c72
- SHA1 809fc494fc9f1f90f071015e0190d93163b4872b
- SHA512 359e4f6cf53c6079a6492a22813c45db3de5a9a6fd8828ea5d44035debe67560adb01b421713e800c78a4a58a642568174449683ae9ed3b1bb69487ca3c5ae7b
- SSDEEP 192:8pAiFQY1BXjuhBytdcq60PDPcvbX2BXsARLt:8pAiyQBXjuhEMqg7wsmLt
- TLSH
  T1E8124523E8501867C387456D9DDBA424E611D92BBA141138FADC912C3F8F578C3FAABD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  claude-code-main/plugins/hookify/core/rule_engine.py
- Size 10KB
- SHA256 3bc18bd7167ab4ea2c06b9693b1994d267e0678c9210db9761c93060607f9fce
- MD5 67a3c92d8506f9fb37a85914161144a3
- SHA1 57b2387026294686ea602b779dbe0f8d85c73e7b
- SHA512 262146ed66a5aba50b63df0c1569801bef82222b34e47fc7ccde6328e0e28ebf895d00f13468810f4347e1e03ebf11943d1417557e646780e0df73de810a38ee
- SSDEEP 192:/WwPIkaegGiCamhWS7ppDixca6ppVdlHJpePY/XTIYgXu8VnoLni:/jAkaegGlaVS7TDKcXpp7lppKcTIhe8
- TLSH
  T1B6224272FCA97C158747D16C99C9D8109725E86B4F441032FB9C9528BF0E634E3F5EA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Python

T1059.006

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Flushes firewall rules

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32