BL @blueteamalerts
hxxps://storage[.]googleapis[.]com/claudeapi/claude[.]html?msclkid=a5ca8dd81bbc1cea0dcee714b86f8877BSC contract 0xc1907d7be91f95903ad66d775c397302e7dd9228eth_call selector 0x6d4ce63c to: bsc-dataseed[.]binance[.]org bsc-dataseed1[.]defibit[.]io bsc-dataseed1[.]ninicoin[.]ioThose RPC nodes are legitimate public infrastructure. Consider alerting on eth_call from noncrypto processes rather than hardblocking if you need it.Files/paths to look for:
Claude.exe + libcef.dll + icudtl.dat together, outside a JetBrains install%LOCALAPPDATA%\Cache-<8hex>\ (u.exe / u.dll / u.bin, x\ subfolder)%TEMP%\w<8hex>\ (launcher.exe + libcef.dll + icudtl.dat + signed.vdf + run.vdf)%APPDATA%\Roaming\LocalCache\Mutexes:
Global\WinCacheSyncGlobal\WinCacheSyncEProcess/behavior to look for:
Claude.exe (jcef_helper.exe) or launcher.exe spawned by steamservice.exepowershell.exe ... Add-MpPreference -ExclusionPath ...writes under HKLM\Software\Valve\Steam\Apps\431960\drop of signed.vdf / run.vdfoutbound eth_call JSON-RPC from a non-crypto processscheduled task CacheMaintenanceTaskHashes we observed. Note the Claude.exe hash is a legitimate signed JetBrains file, so label it or you'll alert on real IntelliJ users
Claude.exe (legit JetBrains jcef_helper.exe, renamed)SHA256: 84292c4128ae5baca4115d3f5049b9fee990d281cc8da6c7a57ea837cda7d239libcef.dll (malicious loader)SHA256: a48c0099a304d4e74ba03e3d593684b841592912852aafb563d9726e815a9e3dicudtl.dat (ICU data + encrypted payload)SHA256: 01ffce3ba619135750e1b8cfed6ab1b74b9d64b1c3f8eb30618f09dc7733b978job.exe (decrypted .NET payload)SHA256: 711b3f407d1f80ad7002dea228f62f4e1b04e4c8e58de5771d4a97c8e15dcca5Full analysis below for anyone who wants the detail.Initial download came from a Google Cloud Storage bucket:
hxxps://storage[.]googleapis[.]com/claudeapi/claude[.]html?msclkid=a5ca8dd81bbc1cea0dcee714b86f8877The download is a bundle of three files that must sit together:
Claude.exelibcef.dllicudtl.datClaude.exe is not Claude. It's a legitimate JetBrains-signed JCEF helper, just renamed:
OriginalFilename: jcef_helper.exeVersion: 137.0.17.1107Signer: JetBrains s.r.o.It imports libcef.dll from its own folder, so the malicious libcef.dll runs under a valid signature. The fake DLL is unsigned, inflated to ~47 MB (probably to beat AV/sandbox size limits), has a mismatched 2023 timestamp, and imports mscoree.dll, which suggests it hosts the .NET runtime. I did not reverse the native loader itself.The real payload is hidden in icudtl.dat. It's genuine ICU 72 data with ~31 KB appended after the last table entry. The blob decrypts with a 32-byte repeating XOR key into a .NET exe:
XOR key: 0ee17baf699b1f1540c4f157fcbf2373fe73ee2e1cb48dd4ce81fd2192fe58afResult: job.exe (.NET assembly)I decompiled job.exe. This is where all the behavior lives.On startup it disables TLS cert validation, sets its working dir, and computes a victim ID:
Working dir: %LOCALAPPDATA%\Cache-<id>Victim ID: first 4 bytes of SHA256(MachineName + UserName), hexTwo mutexes pick which branch runs:
Global\WinCacheSync (normal instance)Global\WinCacheSyncE (elevated instance)For C2 it uses EtherHiding, so there's no domain to block. It sends an eth_call to public BNB Smart Chain nodes, reads the bytes the contract returns, hex-decodes…
