a569f2a5534f9d5990356d260860286e43c1b0eb8290b7e9726ccd7c7d241e5a

Sharing

Copy URL Twitter E-mail

General

Target
Claude-Pro-Relay-Technical-Overview.zip
Size 389KB
Sample260731-qee94aba28
SHA256 a569f2a5534f9d5990356d260860286e43c1b0eb8290b7e9726ccd7c7d241e5a
MD5 9dec83243326a5174e7b84573b611469
SHA1 8fb4ac7cac5911693c7bf241715b5a380f5b5cc1
SHA512 cfaeda92b7702677d799b23e8c2c4e2d6737d05ade4558ac19a7454877516e3a57315d3a4b081c98b0af8d512316c7e4074e93b5b7befd8732090f5f0c95c39c
SSDEEP 12288:Km0QiMbAwgytaYFpT3ksyxRqVJb2ru8ZY:KSiM7gyYi37Su8ZY
TLSH
T1A8841263211288E6CAEB87BC743C8E4C79BB1993BED6231EC727E385746411613E4B75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Claude-Pro-Relay-Technical-Overview/Claude-Pro-Relay-Technical-Overview.lnk
- Size 249KB
- SHA256 8ad109da60e31fc714cf2fb2791b36fdd5817abf62b6022c290538c770cfacac
- MD5 c1f45a0609c5c1bd2c21cad20703f126
- SHA1 bf4a26fe2232eb0829ef20a69ee884f1240d66b3
- SHA512 1b72f2ae047e3a8199d0179892eaaac36b566bb10f30394394bedb82b863c3be6ae3c57e3e280b34ceaacf94498edb0ef62de8ed8cbcd96c09f1e0ff16af9838
- SSDEEP 768:kbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb3:E
- TLSH
  T1B3449E3489421739E2F0457DA0DE6227CB17E4D6D9FA4F2D05AF238827472026EE5F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery execution persistence privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/Claude-Pro-Relay-Technical-Overview.pdf
- Size 154KB
- SHA256 41f93bf6c7373efbeeebcccaa3a9e4db22084ef3fafba3f3ef513e2ddc46bc64
- MD5 e0e156d67134afc840c167e14183aef8
- SHA1 4d8f35a7ba21ae81f778a5fed638fc658ece70b4
- SHA512 767968d9ec983b1f6630b7ea042bc75d25df55c538bf0c0470534265077bd7715779d84127aec799bc0a077e7592caa1a4c70c3df3b404799594298c0e639c68
- SSDEEP 3072:OuhvgTIfNhnBaMSg6fu9rAUyBBVSz5UMlhbkM65eniIbbdN6Ed+BVKUED:OuhviY9E9wUMziNQB
- TLSH
  T180F34AB4F89ACC8CF846B605C06D357D4B9CB1F776C824A60D2C4BCDB00AA55EB235A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/NOVUpdate.exe
- Size 498KB
- SHA256 be153ac4db95db7520049a4c1e5182be07d27d2c11088a2d768e931b9a981c7f
- MD5 3a5b4b08e6ae35fd3ff44ccfb6c4b1aa
- SHA1 b5b57a9737a2572d7920d67455f370237ea3c793
- SHA512 b7d570f0ada7bf7c6893aae06bdb3b182a12ef941c6ed099f17149407395d677fc31736aa2e326b57607be2335c35c659621592c1ea83e59c373f52ccb6a5d81
- SSDEEP 6144:a90odz4lMRUBzynGdXpdMTvyE1NKBmtS/TKA8PCMNf1:a90gmMRUBzFvdMTvyEz+hLXGN
- TLSH
  T1A4B4B4169D80F26EE8E40531555C09378E2B5CEE337788A7A5B63A563C7F2A18CFE017
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/avk.dll
- Size 83KB
- SHA256 d5590802bf0926ac30d8e31c0911439c35aead82bf17771cfd1f9a785a7bf143
- MD5 88ac1c5fc9ee89491c70ea16131e264a
- SHA1 910465739b3170584150e9260bfba6a65e633f35
- SHA512 3b82d2a5a8de77cad0f3ff25e629953690616ec802814d5692b4ccdf15eb60188b3b562232c57bbb26c267fcfe829b90ae4b6fc2329bcbf0a0c03cdd31bab890
- SSDEEP 1536:slkswt5LGk3FpPTKEwhfZvEmd8nwzN68t2PCbzsYDJgzneesW5cdwJeMnx1+:shwt5xpPGEocmd8OZt2PCN1UnmwJeMnm
- TLSH
  T103836B0075D1C075D9BE19351828D6B59B3EB910DFE1DDEB3B9907AA0F302D1EE31A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Claude-Pro-Relay-Technical-Overview/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/_CL_177530/pdf.vbs
- Size 630B
- SHA256 df1ab9210252ad76e3451eeb287747af510658afeb82b22e20bea1c6ddc55131
- MD5 bef0b8599d18acf1c74192ae9f198f85
- SHA1 7275513e1a03b8c75e0eb17b66103ce6c917cc52
- SHA512 567572bdf3b00e6c6026fadfce7f1fc1d587e38d66c6fb37e51c8761a32c924a390ac2fe32fbcc92517077e3b6fa49b71a1c9b915ad7e912ac4a76425b43e6bb
- TLSH
  T112F0F656E922CFB6CB49228E01F69D8D86A350F81611E00CBB1C5C48A71CE3C9D2CACF
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9