MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 224f480d1810539d626ccfaa669d6f6cff0b72b00a88aca83b6ba4a4fed86a85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SilentNet

Vendor detections: 2

Intelligence 2 IOCs YARA 6 File information Comments 1

SHA256 hash:	224f480d1810539d626ccfaa669d6f6cff0b72b00a88aca83b6ba4a4fed86a85
SHA3-384 hash:	845a34a9ace8b4d76ca89e38e90e693f00cb4967cfc6a4f9d5902a66f2fa356cbb0bb976a89b6629a61f6f457f3d0fac
SHA1 hash:	e98aaeccf12151ea7de93fe62106661f2c75b396
MD5 hash:	8641417144f3ef0705259468756b33ce
humanhash:	video-moon-pizza-network
File name:	meteor-dep.jar
Download:	download sample
Signature	SilentNet Create hunting rule
File size:	2'942'071 bytes
First seen:	2026-09-30 00:24:55 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	49152:bcfAEHAittoNSWh7JLxdMgd36y3lpkaf+vsPCNjwn0QYE3axHrnJd2cZMkPc:bPEHhtoNS6JomDr+vsuc/KV9dtlPc
TLSH	T14DD5335364AE4523CA5B376FE0DDAD8680174288BC6A5F32EF7183237FCE6958672107
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	GhostTypes
Tags:	EtherHiding jar minecraft SilentNet stealer

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

jar

Verdict:

No threats detected

Analysis date:

2026-09-30 00:28:26 UTC

Tags:

arch-exec

Link:

https://app.any.run/tasks/8e1f5937-ab47-4d22-a0b3-c5a675928a9c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89750/

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6abc6de1857ed236f5c8daa0/reports/3242e0a2-f7c6-49eb-9f4b-5859a0c76834/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/224f480d1810539d626ccfaa669d6f6cff0b72b00a88aca83b6ba4a4fed86a85

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260930-aqtc4ataqb/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/224f480d1810539d626ccfaa669d6f6cff0b72b00a88aca83b6ba4a4fed86a85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	JAVA_Malware_SilentNet_ForgeAuto_9343a597_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects SilentNet (class, etat extrait)

Rule name:	JAVA_Malware_SilentNet_ForgeAuto_cb879ecb_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects SilentNet (class, etat extrait)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_0ece8eba Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_8814e6c9 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentNet

jar 224f480d1810539d626ccfaa669d6f6cff0b72b00a88aca83b6ba4a4fed86a85

(this sample)

Cape

https://www.capesandbox.com/analysis/89750/

URLhaus

https://urlhaus.abuse.ch/url/3925287/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2026-09-30 02:03:59 UTC

Fake "meteor-dep" dependency jar (dep-disguise TTP: masquerades as a legit meteor-client dependency, version string in filename) from rough-glade-bfc8.pentagon-e8b.workers.dev/deps/. Uniform com/example/mod 6-class kit (donki form), build 2026-09-25 20:34, C2 contract 0x728198F69184f7d7ca607617cb9B79f28e1C43c2 -> antimalwarediagnostics.st. Attribution: cluster-a-fleet-operator.