MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e7448a6c1ef9ae0563e13509c75b20b6aa2483d92f2e20d5274b7dd157f17a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SilentNet

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	0e7448a6c1ef9ae0563e13509c75b20b6aa2483d92f2e20d5274b7dd157f17a3
SHA3-384 hash:	eccfc8083fa7d7500cc2ebdb67f1f61e84754920d55f86ac65e45d8415cc3bde69ca9e57a5896d54279ad61fd02f07b7
SHA1 hash:	305e803581df507788e4ecf15dcf9019d94dd128
MD5 hash:	0844d254917a3519b76d3387c339c2d9
humanhash:	saturn-lithium-delta-montana
File name:	67ClientCracked.jar
Download:	download sample
Signature	SilentNet Create hunting rule
File size:	4'447'676 bytes
First seen:	2026-10-12 18:48:03 UTC
Last seen:	Never
File type:	jar
MIME type:	application/java-archive
ssdeep	98304:Lwx+sHjwX4yGrj8fXsLGb8qD5v3uQ0qJYP9Gbx212/4Ptrb/V:L7Yf8fXsLGVDNTPb412Apb/V
TLSH	T11D2633AB8ADF2CB8E523753DD6041CB3EC3B429499CB5C32542855FA206EE6E1D4F364
TrID	57.8% (.JAR) Minecraft Fabric Mod (24020/2/4) 32.5% (.JAR) Java Archive (13500/1/2) 9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	wok
Tags:	jar java Python SilentNet

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

jar

Verdict:

Malicious activity

Analysis date:

2026-10-12 19:22:28 UTC

Tags:

silentnet stealer etherhiding evasion python arch-exec arch-doc auto generic openssl tool

Link:

https://app.any.run/tasks/dd51e11a-a0fb-4440-8dbf-26b910674b86

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91569/

Detection(s):

SecuriteInfo.com.Trojan.Java.Agent.4345.11624.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad10664f4e17c78f715da12

Tags:

java

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug lolbin obfuscated tracker

Link:

https://www.filescan.io/uploads/6acd2b75819c85f08338a3f8/reports/e6fe3e68-6356-449f-bc46-3dea16f9718b/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0e7448a6c1ef9ae0563e13509c75b20b6aa2483d92f2e20d5274b7dd157f17a3

Verdict:

Unknown

File Type:

jar

First seen:

2026-10-12T16:40:00Z UTC

Last seen:

2026-10-14T03:25:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0e7448a6c1ef9ae0563e13509c75b20b6aa2483d92f2e20d5274b7dd157f17a3/results?tab=lookup

Score:

31%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261012-xfyldshw5r/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SilentNet_FakeFabric_Jar_Container Create hunting rule
Author:	NyxIndius
Description:	Detects fake Fabric mod JAR with net/fabric/ package (not net/fabricmc/) and random class names, associated with SilentNet loader/stealer

Rule name:	SilentNet_FakeFabric_Mod_Jar Create hunting rule
Author:	NyxIndius
Description:	Detects SilentNet Minecraft stealer fake Fabric mod JAR: fabric.mod.json plus random-named classes directly under com/github/ or net/fabric/ (incl. inner classes), without net/fabricmc/