MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


STRRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a
SHA3-384 hash: 94fb32d8e69120eabd21615bae9ed7011c1370bce2a16c5a10784ffab100199783aabe8b543d16aac6229cbc7bf15674
SHA1 hash: b55d64a3bb3abb4716a286f2bf6a39a5e11660ea
MD5 hash: 0ee5a48e87fb06b08d0569d5b8ac3aad
humanhash: triple-earth-nuts-mountain
File name:krypton-crack-newest.jar
Download: download sample
Signature STRRAT
Create hunting rule
File size:18'285 bytes
First seen:2025-12-24 19:57:08 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 384:q65myJeUkLNkR3Er62R3wUhLwA0bZSjaK11zPNWoLn:8AU6R3Erl3wUOA0bwl20
TLSH T1F1822B0BF204A5A7F149E37EC80543445622E5359903F6E37FB5980F0EFB2D9AA862DD
TrID 57.8% (.JAR) Minecraft Fabric Mod (24020/2/4)
32.5% (.JAR) Java Archive (13500/1/2)
9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter burger
Tags:jar STRRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
krypton-crack-newest.jar
Verdict:
No threats detected
Analysis date:
2025-12-24 19:56:51 UTC
Tags:
java
Link:
https://app.any.run/tasks/e1f7ec1d-df61-4d7d-8737-9f76a6d29dd0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45993/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694c458201c7b4a8fe5567b8
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug obfuscated
Link:
https://www.filescan.io/uploads/694c459ae126b9ff4390508f/reports/934729a8-e887-4dd2-97dd-b1db8eb96711/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a
Verdict:
Clean
File Type:
jar
Link:
https://opentip.kaspersky.com/49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a/results?tab=lookup
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
22 / 100
Link:
https://www.joesandbox.com/analysis/1839071
Signature
Joe Sandbox ML detected suspicious sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1839071 Sample: krypton-crack-newest.jar Startdate: 24/12/2025 Architecture: WINDOWS Score: 22 12 Joe Sandbox ML detected suspicious sample 2->12 6 cmd.exe 2 2->6         started        process3 process4 8 java.exe 3 6->8         started        10 conhost.exe 6->10         started       
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-24 19:56:51 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhvs3hwuq5tmlingwyynr5srzhelv7b25lltwerptrgdljvwmqva._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/251224-yphf7sbx8d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/49eb2d9ed48766c5a1a6b630d8f651c9c8bafc3aead73b122f9c4c35a6b6642a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45993/

Comments