MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00fef136014b15d43b28982348e360223f7e1d2d25f5daf5d28b7cba54e14d2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments 1

SHA256 hash:	00fef136014b15d43b28982348e360223f7e1d2d25f5daf5d28b7cba54e14d2f
SHA3-384 hash:	85d3833bc4be93ee7eee7b3a614d8ed3b4f1bc8cfd686687230f909530ac7f5dfa73104a7e4eb8fe0d18935a69ed8364
SHA1 hash:	cc37049a33029d128f392f665de118c3eae8d9a2
MD5 hash:	b7849757d592dcf6d68712e1eb070a78
humanhash:	potato-failed-missouri-fix
File name:	goobaclient-1.21.11.jar
Download:	download sample
File size:	23'601'321 bytes
First seen:	2026-09-30 00:49:37 UTC
Last seen:	Never
File type:	jar
MIME type:	application/java-archive
ssdeep	393216:0oKA98qbqnunAm2tPG8Ww+ka5fdk53INu9DDAMMmNpAEEFZ6Lj5u/8XbGCPLSo:0oF/bTPO+Em5fdk53IQJM4pSi35cYBjb
TLSH	T1AF3733A92CE89439EC27A93944105293F7B8014CD18DF5BA6EEC5B295C73D820717BFE
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	GhostTypes
Tags:	jar MittkeeDropper

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

jar

Verdict:

Malicious activity

Analysis date:

2026-09-30 01:26:03 UTC

Tags:

silentnet stealer python evasion auto generic openssl tool arch-doc

Link:

https://app.any.run/tasks/f1a09965-8860-4134-a0c5-1b2945cd0181

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89755/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ace421d350c7ee8cc14fff9

Tags:

vmdetect java

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-vm

Link:

https://www.filescan.io/uploads/6abc795f03b3a59e58257ad7/reports/94f4c9bf-7a3c-424d-8ee6-adc891f01d88/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/00fef136014b15d43b28982348e360223f7e1d2d25f5daf5d28b7cba54e14d2f

Verdict:

Clean

File Type:

jar

First seen:

2026-09-30T14:57:00Z UTC

Last seen:

2026-10-01T22:06:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/00fef136014b15d43b28982348e360223f7e1d2d25f5daf5d28b7cba54e14d2f/results?tab=lookup

Score:

33%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260930-a63lpsvbjc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/00fef136014b15d43b28982348e360223f7e1d2d25f5daf5d28b7cba54e14d2f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MULTI_Dropper_Unknown_GitHubObfuscated_JAR Create hunting rule
Author:	Marjoriefort
Description:	JAR dropper : classes obfusquees a noms random sous com/github/ (densite >= 4) - famille du resolver GitHub
Reference:	Veille glissante 2026-09-17_22 / grappe 21 JAR

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/89755/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2026-09-30 02:52:24 UTC

Mittkee dropper kit fake client from donutsmpclients.com: real Fabric-mod wrapper with gibberish Main-Class loader, state-machine flow obfuscation, Allatori-style string decryptors and invokedynamic/single-CJK-char BSM reflection obfuscation; self-extracts native stage (discord-rpc.dll Steam stealer) via ProcessBuilder. Watermark "Fucked By Mittkee | discord.gg/myserver131". Operator: raiin-mittkee crew (not SilentNet).