MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5db12ba562fdcea4f3c33fb5d8d9054e1b85508d785f38a7f28e6c63292cf571. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SilentNet

Vendor detections: 6

Intelligence 6 IOCs YARA 5 File information Comments

SHA256 hash:	5db12ba562fdcea4f3c33fb5d8d9054e1b85508d785f38a7f28e6c63292cf571
SHA3-384 hash:	e0a769f6121c91d247b9c93cb55755f9b8128f055e75c59ad4a4546053ee0397403b0369e4461145ba73c2de27658eb7
SHA1 hash:	48f2b2679fdc08ea658d3771d71b5bb53e2c406a
MD5 hash:	da3b72b8eb9c24740b8542aac851cd8f
humanhash:	nebraska-virginia-xray-west
File name:	kryptonclient-1.21.11.jar
Download:	download sample
Signature	SilentNet Create hunting rule
File size:	6'131'440 bytes
First seen:	2026-11-02 18:21:43 UTC
Last seen:	Never
File type:	jar
MIME type:	application/java-archive
ssdeep	98304:rcxgPnk/oEiMGx7C8/Ui5Xs1jmP7KgbnTRHsNUZLWQGWc8IQYrc16j5E0iGlS:rcxgfkgwxi8mP7PnNYUMQ/+QR16j5E0E
TLSH	T15F56331CFDDEA2B9E16311784805E4AB2A4C16CCA545AA2B17B44CEA4F31FCD5B06FDC
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	wok
Tags:	jar java Python SilentNet

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

kryptonclient-1.21.11.jar

Verdict:

Malicious activity

Analysis date:

2026-11-01 20:37:25 UTC

Tags:

silentnet stealer etherhiding evasion auto arch-exec arch-doc

Link:

https://app.any.run/tasks/85cc8c10-5e65-466e-80e0-d031e3e2c3b4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/96855/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae8d4da38ccdea12c56975c

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5db12ba562fdcea4f3c33fb5d8d9054e1b85508d785f38a7f28e6c63292cf571

Result

Malware family:

n/a

Verdict:

Malicious

Trusted hash?:

False

File:

550

Classes:

499

Nested archives:

Source:

https://www.jarscanner.org/

Findings

External process execution: ProcessBuilder can execute operating-system commands.

Verdict:

Unknown

File Type:

jar

First seen:

2026-11-04T09:29:00Z UTC

Last seen:

2026-11-04T09:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5db12ba562fdcea4f3c33fb5d8d9054e1b85508d785f38a7f28e6c63292cf571/results?tab=lookup

Result

Threat name:

EtherHiding

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1996972

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Creates a thread in another existing process (thread injection)

Exploit detected, runtime environment starts unknown processes

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Writes to foreign memory regions

Yara detected EtherHiding

Behaviour

Behavior Graph:

Download SVG

Score:

52%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261102-wzz3wsct5s/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/5db12ba562fdcea4f3c33fb5d8d9054e1b85508d785f38a7f28e6c63292cf571

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ANDROID_Sample_Unique_72544831 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	725448313dcb59422e6cb67fcc1ec11a3f058302e3007aaf0b93a9965225ab4b.jar

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	SilentNet_Donut_Hub_LoaderFleet Create hunting rule
Author:	GhostTypes
Description:	donut kit 2026-10 polymorphic generation: single-letter root loader classes (a-h, the indy-hub table + CJK pool carriers) - catches hub builds even if the UUID .bin stage is renamed away

Rule name:	SilentNet_Donut_UUIDBin_Stage Create hunting rule
Author:	GhostTypes
Description:	SilentNet donut-fleet/kpool loaders: UUID-named .bin encrypted stage at jar root (sha256-class oracle table in donut builds)

Rule name:	SilentNet_Mittkee_Hub_NativeStage Create hunting rule
Author:	GhostTypes
Description:	donutsmpclients.com hub generation (Mittkee/Raiin, 2026-10): native payload stage - hex-hash native/ dirs (runtime spawn path), corz-family fz/ns/re two-letter root bins, krypton jnt lane (diddy.mixins.json, dev/krypton/native)