🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84
SHA3-384 hash: fcf6251ace44a2c977f547d3fe8a761f75be539687706de85294d8216c06ee5897e79a77a50603285bcbbde77458c10d
SHA1 hash: ae81e88678d47ecb6ef9dad861edc8ff0da71951
MD5 hash: 035e1579c1946fe4a988d35615ee8c64
humanhash: eleven-green-blossom-colorado
File name:325a6f8423e68cf7.bin
Download: download sample
File size:1'566'674 bytes
First seen:2026-10-05 20:23:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:vBRXkF8k510cD2UW506FT6EAIb4uEz3RrzAS/0cr/J8G9u9XYedf0nOVzfP/H33S:v0KcaUW508TBQhzR/0geGM97d8O5f3i
TLSH T1A7753306967CB403E8B203748B4DB2ADCAC5701A0DC4CA7B5E7992619D5EED84D3CDFA
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter Tuxxin
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
US US
File Archive Information

This file archive contains 9 file(s), sorted by their relevance:

File name:MANIFEST.MF
File size:414 bytes
SHA256 hash: f20cbc7766cb9d9b3445c58e8402e9ec6da7454fa0ea62555939b6e56c8c2c0e
MD5 hash: bb6ee1fa6f1321a97516851800129f08
MIME type:text/plain
File name:en_us.json
File size:226 bytes
SHA256 hash: 6691204c334151adc8653b2d91acbf77fe28acc9254acd938bc1ff0872af518b
MD5 hash: 906dd91683991ec5d3870fa012aa5c76
MIME type:application/json
File name:github-mixin-loader-2.5.2-obfuscated.jar
File size:1'559'986 bytes
SHA256 hash: 73299176ee29117d28d8a1f8ea312397aadce736076db6583b2a2c6b5a2ff70e
MD5 hash: 81707eff68139fddfca2288ea59ee8b4
MIME type:application/java-archive
File name:GuiMixin.class
File size:3'323 bytes
SHA256 hash: 4ef2903224d60dd8870fe1cc86d969e88755609ad5302e90c276ab2ca756733a
MD5 hash: ebe2e51be2d02598868e842183850767
MIME type:application/x-java-applet
File name:icon.png
File size:6'312 bytes
SHA256 hash: 429b3cc4b15868de72a3aec6118b8e1a82fe84e56b6735095dc62fad6d5ec3c3
MD5 hash: 3c273febce9d9066b9a6e564ee71bf74
MIME type:image/png
File name:LICENSE_toggle-sprint-display
File size:7'815 bytes
SHA256 hash: f831e7eed577481687a9bc0b48024e5e40b6f655fcde073ede964b50be5d55d9
MD5 hash: cc46e3e9ef97cbdc56318ee7ff23d73e
MIME type:text/plain
File name:toggle-sprint-display.mixins.json
File size:279 bytes
SHA256 hash: 15f47095d52ae6659f685f26a8636942ce6b7c974359b81bf37b03c002e2f2b7
MD5 hash: baebace0977c87e578a3c457eb1985ba
MIME type:text/plain
File name:fabric.mod.json
File size:599 bytes
SHA256 hash: 6c2c6b86ebac984dc2699ed0c0cf654349cea0cf69e13ce676cdcbe4e04eb4e0
MD5 hash: bb777637635b4a8170bf20133d4f5d0e
MIME type:text/plain
File name:toggle-sprint-display-refmap.json
File size:422 bytes
SHA256 hash: 5f15bffdb82561697b7c9beb33733c736ef4e9ac65238aa8b9f4db96f3880279
MD5 hash: 392de46494a37307bc662782de53512d
MIME type:application/json
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Java.SuspAttach.52621958.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac0b91059bf6e2f9e92ceb3
Tags:
n/a
Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6ac4076ea891737991717204/reports/09e3bd4d-35a2-4ad4-aa93-769905bc698a/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84
Verdict:
Unknown
File Type:
jar
Link:
https://opentip.kaspersky.com/325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Zip Archive
Link:
https://app.malva.re/file/035e1579c1946fe4a988d35615ee8c64
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84/
Threat name:
ByteCode-JAVA.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-18 18:47:28 UTC
File Type:
Binary (Archive)
Extracted files:
34
AV detection:
7 of 36 (19.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gjng7bbd42gpphk52ayc6njhjmvxr56ubyl4zmwqvtz2bffzvsca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ANDROID_Sample_Unique_2599c5a6
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:2599c5a6191bc208c4f0f1fcafba81b0f8d4099de6dc8d64ee7aec0b5289833e.jar
Rule name:JAVA_Malware_SilentNet_ForgeAuto_b44026bb_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects SilentNet (class, etat extrait)
Rule name:JAVA_Malware_Unknown_ForgeAuto_24ab100f
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_705fb75e
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_90eece6c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat extrait)
Rule name:JAVA_Malware_Unknown_ForgeAuto_bc333af1
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_6dc545a6
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_b2a4008d
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_PUA_ToggleSprintMod_MassSubmit
Create hunting rule
Author:Marjoriefort
Description:Mod Minecraft toggle-sprint-display (com.aeltumn) soumis en masse - pattern anormal + mixin-loader obfusque, PUA a confirmer
Reference:misses_archive 569 / grappe 39 archives identiques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 325a6f8423e68cf79d5dd0302f35274b2b78f7d40e17ccb2d0acf3a094b9ac84

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3917247/

Comments