MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31c33d85ee263b0f588951c26e5e668d320c9631efd19ddf76de0ab11a41ea86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	31c33d85ee263b0f588951c26e5e668d320c9631efd19ddf76de0ab11a41ea86
SHA3-384 hash:	a59b964e29228c41120b439d929672a9d2376f2ead74694627b72a0b7691cfac2870a377b2d80c976d28099a4482fbfe
SHA1 hash:	683742aa05403faf8390db1612246ce377bca637
MD5 hash:	568ef5ea4d057250241c3a7f3af0a6d3
humanhash:	queen-network-uncle-ceiling
File name:	GAMBLERIGMODV12.jar
Download:	download sample
Signature	SilentNet Alert Create hunting rule
File size:	4'956'820 bytes
First seen:	2026-07-01 09:02:48 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	98304:/JO6QlUTRZD4QoSrKvbcOfsfGlSrnYpHuJSGvYKh6pnDdkoAaMkXsg:eYRZsQfKzrf0Gl4nQYpYKiXwg
TLSH	T16C36236FF5ADAB1AD3E7DCB464C40F53EC8623C0E484527B3260276369A6D9F1B85348
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	burger
Tags:	jar SilentNet

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

112

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

GAMBLERIGMODV12.jar

Verdict:

Malicious activity

Analysis date:

2026-07-01 01:00:07 UTC

Tags:

silentnet stealer etherhiding evasion python arch-exec arch-doc openssl tool

Link:

https://app.any.run/tasks/0daccdae-01fa-4e7b-a643-4aa37ca162a5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72560/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.80650183.223.27808.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a44669486bc95245bfb0872

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug obfuscated

Link:

https://www.filescan.io/uploads/6a44d7ee408b01d32865f780/reports/2ae149c0-0009-46f0-a86c-c934fc4a08ba/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/31c33d85ee263b0f588951c26e5e668d320c9631efd19ddf76de0ab11a41ea86

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

jar

First seen:

2026-06-28T18:20:00Z UTC

Last seen:

2026-07-01T00:08:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Java.Generic

Link:

https://opentip.kaspersky.com/31c33d85ee263b0f588951c26e5e668d320c9631efd19ddf76de0ab11a41ea86/results?tab=lookup

Joe Sandbox SilentNet

Result

Threat name:

SilentNet

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1935981

Signature

Allocates memory in foreign processes

Creates a thread in another existing process (thread injection)

Exploit detected, runtime environment starts unknown processes

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Writes many files with high entropy

Writes to foreign memory regions

Yara detected SilentNet

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/31c33d85ee263b0f588951c26e5e668d320c9631efd19ddf76de0ab11a41ea86

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/31c33d85ee263b0f588951c26e5e668d320c9631efd19ddf76de0ab11a41ea86/

Neiki Family.SILENTNET

Verdict:

Malicious

Threat:

Family.SILENTNET

Link:

https://tip.neiki.dev/file/31c33d85ee263b0f588951c26e5e668d320c9631efd19ddf76de0ab11a41ea86

ReversingLabs TitaniumCloud Package.Trojan.Ravartar

Threat name:

Package.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-28 05:07:32 UTC

File Type:

Package (Java)

Extracted files:

684

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ghbt3bpoey5q6wejkhbg4xtgruzazfrr57iz3x3w3yflcgsb5kda._file

Hatching Triage silentnet

Result

Malware family:

silentnet

Alert

Create hunting rule

Score:

  10/10

Tags:

family:silentnet stealer

Link:

https://tria.ge/reports/260701-kz9rjsct9y/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/31c33d85ee263b0f588951c26e5e668d320c9631efd19ddf76de0ab11a41ea86

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/72560/