🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025
SHA3-384 hash: 738e6ff653353bb1bf35190dd4e22b95535b9bbf29b70bf847ee173e7f9ad940c8b182dcecb4eb74dc306c05344ebcbf
SHA1 hash: 00971b848b11f08e1812daa5187105c62ffecb98
MD5 hash: c9a2c2cf8fefd7504d510ea723566e93
humanhash: december-autumn-friend-artist
File name:3ec304fb79a6806d.bin
Download: download sample
File size:1'566'751 bytes
First seen:2026-09-28 15:25:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:5l9OVrUMDyQMBCmFZOE+AJA2INl1r9iyD0ctlBqUloZt4cd1GfePzfPhD39b2cW+:ngYMGQMBC4Z/Wx97D0Y8U2ZfdIm7p3p
TLSH T1E9753306A5BCA803FC730275478D63A98AC9B05B0D849E674E7953718D5FFC84D2CEBA
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter Tuxxin
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
US US
File Archive Information

This file archive contains 9 file(s), sorted by their relevance:

File name:MANIFEST.MF
File size:414 bytes
SHA256 hash: f20cbc7766cb9d9b3445c58e8402e9ec6da7454fa0ea62555939b6e56c8c2c0e
MD5 hash: bb6ee1fa6f1321a97516851800129f08
MIME type:text/plain
File name:en_us.json
File size:226 bytes
SHA256 hash: 6691204c334151adc8653b2d91acbf77fe28acc9254acd938bc1ff0872af518b
MD5 hash: 906dd91683991ec5d3870fa012aa5c76
MIME type:application/json
File name:github-mixin-loader-2.5.2-obfuscated.jar
File size:1'560'041 bytes
SHA256 hash: fe97ad5b77abee84aca1491b0804e1bfe62a655d1628dd5124722ba6f2ea85c9
MD5 hash: c312249e4702a786dc3d1f855c770b86
MIME type:application/java-archive
File name:GuiMixin.class
File size:3'323 bytes
SHA256 hash: 4ef2903224d60dd8870fe1cc86d969e88755609ad5302e90c276ab2ca756733a
MD5 hash: ebe2e51be2d02598868e842183850767
MIME type:application/x-java-applet
File name:icon.png
File size:6'312 bytes
SHA256 hash: 429b3cc4b15868de72a3aec6118b8e1a82fe84e56b6735095dc62fad6d5ec3c3
MD5 hash: 3c273febce9d9066b9a6e564ee71bf74
MIME type:image/png
File name:LICENSE_toggle-sprint-display
File size:7'815 bytes
SHA256 hash: f831e7eed577481687a9bc0b48024e5e40b6f655fcde073ede964b50be5d55d9
MD5 hash: cc46e3e9ef97cbdc56318ee7ff23d73e
MIME type:text/plain
File name:toggle-sprint-display.mixins.json
File size:279 bytes
SHA256 hash: 15f47095d52ae6659f685f26a8636942ce6b7c974359b81bf37b03c002e2f2b7
MD5 hash: baebace0977c87e578a3c457eb1985ba
MIME type:text/plain
File name:fabric.mod.json
File size:619 bytes
SHA256 hash: f8211bb76780b76953e82892499e29df99481969169828dccdb2bc66891ab2b6
MD5 hash: 2a648fd91874495a0dbf18438a3ca022
MIME type:text/plain
File name:toggle-sprint-display-refmap.json
File size:422 bytes
SHA256 hash: 5f15bffdb82561697b7c9beb33733c736ef4e9ac65238aa8b9f4db96f3880279
MD5 hash: 392de46494a37307bc662782de53512d
MIME type:application/json
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Java.SuspAttach.87295173.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac0b91059bf6e2f9e92ceb3
Tags:
n/a
Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025/results/dashboard
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6aba87161e2cc924ee5ffa66/reports/18e999e3-bcc0-45d9-b53e-49f2405c1e77/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025
Verdict:
Unknown
File Type:
jar
First seen:
2026-09-28T13:27:00Z UTC
Last seen:
2026-09-28T13:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Zip Archive
Link:
https://app.malva.re/file/c9a2c2cf8fefd7504d510ea723566e93
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-19 12:39:03 UTC
File Type:
Binary (Archive)
Extracted files:
34
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3bqj63zu2ag3libjivqhiwrwmws3onysme4odggyo7a3q72uasq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260928-xbebyssscx/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ANDROID_Sample_Unique_2599c5a6
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:2599c5a6191bc208c4f0f1fcafba81b0f8d4099de6dc8d64ee7aec0b5289833e.jar
Rule name:JAVA_Malware_Unknown_ForgeAuto_24ab100f
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_705fb75e
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_90eece6c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat extrait)
Rule name:JAVA_Malware_Unknown_ForgeAuto_bc333af1
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_6dc545a6
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_b2a4008d
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_PUA_ToggleSprintMod_MassSubmit
Create hunting rule
Author:Marjoriefort
Description:Mod Minecraft toggle-sprint-display (com.aeltumn) soumis en masse - pattern anormal + mixin-loader obfusque, PUA a confirmer
Reference:misses_archive 569 / grappe 39 archives identiques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 3ec304fb79a6806dad014a2b03a2d1b32d2db9b89309c70cc6c3be0dc3faa025

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3917225/

Comments