Updater’s `.cln` child matches the submitted file’s content
A suspicious extension made the updater’s child process look like a separate executable, but its SHA-256 matches the submitted sample. The finding shifts attention to the file’s patch-oriented activity without establishing whether its update content is trustworthy.
A PangYa-branded updater launched a child process named updater_signed.cln. The unusual extension triggered a suspicious-file-type rule, but the process record contains a more revealing detail: the child’s SHA-256 matches the submitted updater sample. What appears at first to be an unexplained extra executable is the known file’s content running under another name. That raises a more useful question than whether .cln looks suspicious: what work does this updater perform?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read