🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b6bc8ee0ec5ba16900e54dd18d4b131fd4dcec786cf904db7435ea5df29ff38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SilentNet


Vendor detections: 4


Intelligence 4 IOCs YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b6bc8ee0ec5ba16900e54dd18d4b131fd4dcec786cf904db7435ea5df29ff38
SHA3-384 hash: 12adfa8545752663e6989bc2be1e7a61375225746ff7f6d0328f6a4dcad5b9b30ca1c1f432ea2eecf6a5d3a6c8288acc
SHA1 hash: 2bcf8da40219d6ef370c84cbfdc5cb4b4f8a53ff
MD5 hash: 43913b06303e58be9f59de70e4428f62
humanhash: delaware-hawaii-crazy-emma
File name:cheetoclient.org__cheeto-client-6.9.jar.quarantined
Download: download sample
Signature SilentNet
Create hunting rule
File size:62'049 bytes
First seen:2026-10-26 14:22:17 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 1536:4rcln6sNFAp5AY8W39H9tj2U3+AIkNGa/x44rz:v6s08hYH9tSQ+3kNGai4v
TLSH T13953F1A56FE1913DC70346B68DD1CB23381E5A987105E61F0A59F0D2A893C4A339EFF9
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter GhostTypes
Tags:jar SilentNet


Avatar
GhostTypes
SilentNet loader. File type: Minecraft Fabric mod (.jar). Source: https://cheetoclient.org/ (a fake Minecraft client download site). The jar contacts blockchain RPC nodes to get its C2 host. The contract is not decoded. Verdict: static analysis with bbmmd. The sample was not executed.

Intelligence

File Origin
# of uploads :
1
# of downloads :
30
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95106/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6adf6f03afb06e650cd9362f
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1b6bc8ee0ec5ba16900e54dd18d4b131fd4dcec786cf904db7435ea5df29ff38
Result
Malware family:
n/a
Verdict:
Suspicious
Trusted hash?:
False
File:
26
Classes:
19
Nested archives:
0
Source:
https://www.jarscanner.org/
Verdict:
Unknown
File Type:
jar
Link:
https://opentip.kaspersky.com/1b6bc8ee0ec5ba16900e54dd18d4b131fd4dcec786cf904db7435ea5df29ff38/results?tab=lookup
Result
Threat name:
SilentNet
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1993093
Signature
Yara detected SilentNet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1993093 Sample: cheetoclient.org__cheeto-cl... Startdate: 27/10/2026 Architecture: WINDOWS Score: 48 12 Yara detected SilentNet 2->12 6 cmd.exe 1 2->6         started        process3 process4 8 java.exe 3 6->8         started        10 conhost.exe 6->10         started       
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/1b6bc8ee0ec5ba16900e54dd18d4b131fd4dcec786cf904db7435ea5df29ff38
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b6bc8ee0ec5ba16900e54dd18d4b131fd4dcec786cf904db7435ea5df29ff38/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dnv4r3qoyw5bneaoktorrvfrgh6u3twhq3hzatnxinpklxzj744a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261026-sn8n4sfx4r/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b6bc8ee0ec5ba16900e54dd18d4b131fd4dcec786cf904db7435ea5df29ff38

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:JAVA_Malware_SilentNet_ForgeAuto_b44026bb_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects SilentNet (class, etat extrait)
Rule name:JAVA_Malware_Unknown_ForgeAuto_0ece8eba
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_24ab100f
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_705fb75e
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_90eece6c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat extrait)
Rule name:JAVA_Malware_Unknown_ForgeAuto_bc333af1
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_6dc545a6
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_b2a4008d
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentNet

Java file jar 1b6bc8ee0ec5ba16900e54dd18d4b131fd4dcec786cf904db7435ea5df29ff38

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/95106/

Comments


Avatar
GhostTypes commented on 2026-10-26 14:22:22 UTC

SilentNet loader. File type: Minecraft Fabric mod (.jar). Source: https://cheetoclient.org/ (a fake Minecraft client download site). The jar contacts blockchain RPC nodes to get its C2 host. The contract is not decoded. Verdict: static analysis with bbmmd. The sample was not executed.