MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f3daa7799506430155c12f9201e0725564a4de1bae7efffe64fb94bf24bac41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SilentNet

Vendor detections: 6

Intelligence 6 IOCs YARA 35 File information Comments

SHA256 hash:	4f3daa7799506430155c12f9201e0725564a4de1bae7efffe64fb94bf24bac41
SHA3-384 hash:	7cc948781d4d276ff1784ffe66ebd5d58f3b4c8f123b829221292db67ece0bd287cee53a1513aa9d54bac9dda3ca29e2
SHA1 hash:	74e25e64a4d956758a67650fbbd5b7d4cdd3c079
MD5 hash:	50a53222fa30a83dbdfea8cc561f82d8
humanhash:	delta-sad-yellow-avocado
File name:	Prestige-1.20-1.0.jar
Download:	download sample
Signature	SilentNet Create hunting rule
File size:	7'888'070 bytes
First seen:	2026-10-01 14:46:53 UTC
Last seen:	2026-10-03 10:38:30 UTC
File type:	jar
MIME type:	application/zip
ssdeep	196608:v11111111111111111111111111111111111111111111111111111111111111l:B
TLSH	T16586E0DAA8B947B7E4F8A674C2808C43E6B9ACC28714B17DF9240FBC57B415B38D5487
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	C0RSA
Tags:	donutsmp EtherHiding jar java Prestige SilentNet

C0RSA

silentnet-family Minecraft stealer. Prestige-1.20-1.0.jar - repack of 'prestige' with injected entrypoint com.github.eZ3xfiOQgTI.
Campaign tag: 9ebad53b-2661-4d29-bfc3-6f7b705b68b3
Steals MC session (username, UUID, accessToken) -> POST /shard/prefireMc, then PNG-stego second stage -> portable Python -> main.py. Uploads latest.log -> /shard/submitMinecraftLog.
C2 via Polygon contract 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (selector 0xce6d41de).
Stage 2: /cdn/e/3b8f6d2a9c1e
Headers: X-Edge-Cache-Revalidate, X-Runtime-Env
Resolves C2 via DoH (cloudflare-dns.com / 1.1.1.1).

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

jar

Verdict:

Malicious activity

Analysis date:

2026-10-01 16:01:32 UTC

Tags:

silentnet stealer python arch-exec arch-doc evasion auto generic openssl tool arch-scr

Link:

https://app.any.run/tasks/44aded3f-c4b7-441c-917b-2a5bb3d9c1c6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90097/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aceaf292e5d8a93d815281f

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4f3daa7799506430155c12f9201e0725564a4de1bae7efffe64fb94bf24bac41

Verdict:

Malicious

File Type:

jar

First seen:

2026-07-28T21:09:00Z UTC

Last seen:

2026-09-06T11:09:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4f3daa7799506430155c12f9201e0725564a4de1bae7efffe64fb94bf24bac41/results?tab=lookup

Score:

Verdict:

Benign

File Type:

Result

Malware family:

silentnet

Score:

10/10

Tags:

family:silentnet stealer

Link:

https://tria.ge/reports/261001-r52rfswtgv/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/4f3daa7799506430155c12f9201e0725564a4de1bae7efffe64fb94bf24bac41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	JAVA_Malware_Unknown_ForgeAuto_02635fc2 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_03a7ca91 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_0ece8eba Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_1fde0fe5 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_24ab100f Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_2df056cd Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_4b3cb567 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_50b45f1d Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_5888acd8 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_5babfab8 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_5dd8d8b7 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_61773a0a Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_6e2e769f Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_705fb75e Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_79e65b39 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_801563da Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_841e376a Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_8814e6c9 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_89197504 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_898655ff Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_90eece6c_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat extrait)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_93d2b659 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_9d580dd6 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_be69aa21 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_c6a9f141 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_e1eeca57 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Sample_Unique_76bcfb74 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	MULTI_Dropper_Unknown_GitHubObfuscated_JAR Create hunting rule
Author:	Marjoriefort
Description:	JAR dropper : classes obfusquees a noms random sous com/github/ (densite >= 4) - famille du resolver GitHub
Reference:	Veille glissante 2026-09-17_22 / grappe 21 JAR

Rule name:	MULTI_Malware_Unknown_ForgeAuto_14fe019b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (inconnu, etat binaire)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_6dc545a6 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (inconnu, etat binaire)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_9d9a5cf9 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (inconnu, etat binaire)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_b2a4008d Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (inconnu, etat binaire)

Rule name:	MULTI_Malware_Unknown_ForgeAuto_de8d8480 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (inconnu, etat binaire)

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentNet

jar 4f3daa7799506430155c12f9201e0725564a4de1bae7efffe64fb94bf24bac41

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/90097/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample