A signed “update check” that only tells the truth to victims

About this post. Thanks to MalwareHunterTeam for flagging this new payload. This analysis and write-up were produced by Claude (Opus 5.5), working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat, capa, FLOSS, KesaKode, a sandboxed Wine run with gdb, Python (pefile, pycryptodome), ANY.RUN and Recorded Future Triage.

Update, 13 October 2026. A second build of the same program, inpo.exe, gave us a likely family name and answered the "who is this aimed at?" question this post originally left open. The new section "A sibling build names the family" covers it, and the TL;DR, advice and indicators below have been updated to match.

TL;DR

a1bx5.exe is a small Windows program signed with a three-day Microsoft Trusted Signing certificate. Before doing anything else it decides whether it is running inside an analysis lab. In a lab it pops up a harmless-looking "No update found." box and quits. On a real PC it installs itself, schedules itself to run every three minutes, and reports the computer’s details to cloudwindowapps[.]com so the operator can send down the next stage.

• Signed: "KATHRYN BANNER" via Microsoft Trusted Signing, valid for only 3 days (2026-04-08 to 04-11).
• Lab-aware: about 16 checks. Two failures are enough to switch to the decoy.
• Persistent: copies itself to %APPDATA%\Mythlcsoft\SqlQUeryInt.exe and adds a scheduled task named "RAS Right Template Management".
• Check-in: HTTP POST to hxxp://cloudwindowapps[.]com/enclose-pdf with the PC name, user name, Windows version, antivirus product and a campaign label POLICE.
• Next stage: a download-and-run routine exists, but we never saw what it delivers.
• Family (update): most likely Spyder, a downloader publicly attributed to the Patchwork espionage group. A sibling build is labelled for "AJK Police", most plausibly the Azad Jammu & Kashmir Police in Pakistan.

But it’s signed!

Code signing is a digital seal that says who published a program and proves the file hasn’t been changed since. It’s meant to build trust, and that is exactly why malware authors want it. This file’s seal is genuine and intact. It was issued through Microsoft’s Trusted Signing service to an individual, "KATHRYN BANNER" of Anchorage, Alaska, and it was valid for just three days.

Short-lived certificates in individual names, used once to sign malware, are a pattern we see again and again. A valid signature tells you who paid for the seal, not whether the program is safe. The certificate has been reported and added to the CertGraveyard.

The file is also oddly large: 11 MB, of which exactly 10,000,000 bytes are zeros. That padding does nothing except make the file bigger. Some security tools skip files over a certain size, so bloating a small program is a cheap way to slip past them.

Step one: "Am I being watched?"

The first thing the program does is run a checklist that a malware analyst’s machine tends to fail:

• Is this a virtual machine (VMware, VirtualBox, KVM, QEMU, Parallels)?
• Is a debugger attached?
• Are tools like Wireshark, x64dbg, IDA, Fiddler or Process Hacker running, or are their windows open?
• Does the machine have a real network adapter with a real IP address?
• Does the process count look like a lived-in computer?

Each failed check adds a strike, and two strikes are enough. The program then shows this:

It also sends a web request to a Chinese-localised fork of the PuTTY SSH client on GitHub (github[.]com/larryli/PuTTY), the kind of traffic an "update checker" would plausibly make. GitHub is not involved in the attack; the request is set dressing.

This is why public sandboxes struggle with it. In ANY.RUN the program took the decoy branch, contacted only GitHub, and received a "Suspicious" score of 65 with no sign of the real server. In our own isolated test environment it failed four checks: no serial/USB ports in the hardware query, only a loopback network adapter, and the process count, which was counted twice.

Peeking past the curtain

To see the real behaviour, we skipped the lab check in a copy of the program and ran it in a sealed sandbox with no internet access. The settings it needs are stored encrypted inside the file, which is like keeping the instructions in a locked box with the key taped to the lid. The key is built inside the program’s own code. With it, the encrypted settings decrypted cleanly:

Every other interesting text string in the program is locked the same way with a second key, and we unlocked those too.

Moving in

Once it is satisfied it’s on a real computer, the program:

1. Copies itself to %APPDATA%\Mythlcsoft\SqlQUeryInt.exe. "Mythlcsoft" looks like a near-miss spelling of the real company Mythicsoft.
2. Creates a scheduled task (a Windows feature that runs programs automatically on a timer) called "RAS Right Template Management". The task’s start date is in 2025, which is already in the past, so it fires straight away and then every three minutes with no end date.

Checking in

Next it builds a profile of the computer and posts it to the attacker’s server:

• a unique ID: an MD5 fingerprint of the disk’s serial number and the network card’s MAC address;
• computer name and DOMAIN\user;
• Windows version;
• installed antivirus, or NoAV. It also specifically looks for Rising Antivirus, a Chinese product;
• the labels Agnt=U1, Profile=POLICE and police@gov[.]ar.

It sends this as a plain, unencrypted HTTP request with the generic user agent WinHTTP Example/1.0. In our sandbox the server was unreachable, so it simply tried again roughly every three seconds.

What the local analysis couldn’t reach

The program has a section that reads the server’s reply, creates a folder under %LOCALAPPDATA%\SalesForce\, saves a file there and launches it. Strings such as wirelessdriverupdate.exe suggest what that file may be called. We didn’t contact the real server, and we didn’t recover the reply format or the next-stage payload. So we can’t say what this campaign ultimately installs.

When we first published, the targeting was unclear: the POLICE / police@gov[.]ar labels didn’t obviously point anywhere. The sibling build below shows that these are per-target labels typed into the builder, and that one of them names a police force in Pakistani-administered Kashmir. The Chinese-flavoured details (the PuTTY fork used as a decoy, the Rising Antivirus check) don’t fit that picture and remain unexplained.

A sibling build names the family

After this post went up, a second sample, inpo.exe, was seen talking to the same cloudwindowapps[.]com address. It is the same program built with different settings: identical code fingerprint (import hash), the same two encryption keys and the same settings layout, so the method above unlocked it unchanged. This build is not signed and isn’t padded with zeros. What changes is what the operator typed into the builder:

Two things stand out.

The family name. The developer’s own build folder is called Spyder. Spyder is the name security researchers use for a downloader attributed to Patchwork, a long-running espionage group. Recorded Future Triage’s Spyder detection rule also fires on the installed copy of inpo.exe, and Patchwork’s usual targets are government and security bodies in Pakistan and its neighbours. Code-similarity matching (KesaKode) didn’t confirm the link, though, and we haven’t compared it against the original vendor reports. So treat this as a likely identification, not a confirmed one.

The target. "AJK Police" most plausibly means the Azad Jammu & Kashmir Police, which fits that profile. Seen in that light, POLICE in our sample is another target label of the same kind. The police@gov[.]ar value next to it is probably free text rather than a sign of Argentine targets, but we can’t confirm that.

We also looked at existing public Triage runs of inpo.exe. Unlike ANY.RUN, those sandboxes got past the lab check and reached the real server, an ordinary web application behind Cloudflare. In April 2026 it answered every three-second check-in with a single character: 0. The page didn’t show the reply body, but the server’s ETag header (a hash of the body) gave it away. By May the same address returned "page not found". In other words, the server was listening but handing out no work to sandboxes, and none of the public runs received a next stage.

What should you do?

If you’re a regular user

• A valid signature is not a safety guarantee. Be wary of unexpected programs, even signed ones, especially ones that claim to "check for updates" and then do nothing.
• If you find %APPDATA%\Mythlcsoft\ or a scheduled task called "RAS Right Template Management", treat the machine as compromised and get help.

If you’re a defender

• Block and hunt cloudwindowapps[.]com, and look for POSTs to /enclose-pdf with user agent WinHTTP Example/1.0. ET rule sid 2064127 already flags that user agent.
• POSTs to github[.]com/larryli/PuTTY with that user agent are a sign the program ran and took the decoy branch.
• Hunt for the scheduled-task names (RAS Right Template Management, WinHelper), the Mythlcsoft, Compser and SalesForce AppData folders, and the certificate serial below. Other builds will use other names, so the user agent and the /enclose-pdf path are the more durable signals.
• Sandbox verdicts of "Suspicious" may be all you get for this one; the lab check hides the interesting part.

Indicators of compromise

Wrapping up

This one isn’t flashy. It is a small signed program that is very good at looking boring when it is being watched, and that is enough to earn it a lukewarm sandbox score while it waits for a real victim. The sibling build put a probable name and target on it: Spyder, aimed at least in part at police in Pakistani-administered Kashmir. What the operator sends once a real victim checks in is still unknown. If you’ve seen cloudwindowapps[.]com hand out anything other than 0, or you have the lure that delivered either file, we’d love to hear about it. The public sandbox runs are at ANY.RUN (this sample) and Triage (inpo.exe).