MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1355a1de74bb2b3d4d9f1d371cedb7dda2c6c413269574f711271e69bc2d0b1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1355a1de74bb2b3d4d9f1d371cedb7dda2c6c413269574f711271e69bc2d0b1b
SHA3-384 hash:	c42a8df89939affb815ce506dba412e804db8507cd8f13cafc0611491c8e7143759bf7e18fdfcd7a84b6882bfdf64e00
SHA1 hash:	b5f033bf41dfec100601328bf649656169debd90
MD5 hash:	bd18cd9822ed720006efd28dc93ce21f
humanhash:	timing-india-march-saturn
File name:	client.jar
Download:	download sample
File size:	30'779'827 bytes
First seen:	2026-10-14 05:05:55 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	393216:OL4xRkL2YgyzSwAjOxtPCvJsnlWKVSreRYQx8tnWNdksh+W64IcBscMj2ROOqwKt:04nkL2fmS+AxslW2RR6WRI8fMaQOOt
TLSH	T1C5670223D948F63DE936433AE0420592B95F17ECD80F90A564F029FAAD05D4D3FA1BE9
TrID	43.7% (.SPE) SPSS Extension (30000/1/7) 19.7% (.JAR) Java Archive (13500/1/2) 15.3% (.LITEMOD) Minecraft LiteLoader Mod (10500/1/2) 15.3% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 5.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	rc4
Tags:	jar runelure stealer

rc4

Trojanized RuneLite client, sends Jagex Launcher credentials/legacy usernames/passwords & account bank value to webhooks.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

105

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

https://stellaspicy.org/2026scrill/client.jar

Verdict:

Suspicious activity

Analysis date:

2026-10-14 04:48:45 UTC

Tags:

arch-doc evasion

Link:

https://app.any.run/tasks/c21e9b0f-f420-4c15-83b4-e4abf95f9220

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1355a1de74bb2b3d4d9f1d371cedb7dda2c6c413269574f711271e69bc2d0b1b

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

jar

First seen:

2026-10-14T02:43:00Z UTC

Last seen:

2026-10-14T03:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1355a1de74bb2b3d4d9f1d371cedb7dda2c6c413269574f711271e69bc2d0b1b/results?tab=lookup

Nucleon Malprob Susipicious

Score:

53%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/1355a1de74bb2b3d4d9f1d371cedb7dda2c6c413269574f711271e69bc2d0b1b

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cnk2dxtuxmvt2tm7du3rz3nx3wrmnrate2kxj5yre4pgtpbnbmnq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/261014-frlyasfz5v/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/1355a1de74bb2b3d4d9f1d371cedb7dda2c6c413269574f711271e69bc2d0b1b