🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67d2cf32ba9cd0005efd57c1224360875c8c4ce69b8dec37af85c690c16c568e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SilentNet


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67d2cf32ba9cd0005efd57c1224360875c8c4ce69b8dec37af85c690c16c568e
SHA3-384 hash: a89f760853a0f279a309dc4bd1d1d548a30299accc807ae383d8818d2990fee9b0b610652421aa9794ad91a8306fda8a
SHA1 hash: cf448ec13ffe57b95e6822f14c8c27647fabcd11
MD5 hash: 4ace9833c0e88c6a7470fdd06a5b68d9
humanhash: sad-princess-quiet-arkansas
File name:meteor-rejects-addon-1.21.11-meteorrejects.net.jar.q
Download: download sample
Signature SilentNet
Create hunting rule
File size:3'287'028 bytes
First seen:2026-09-13 23:07:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:yCBm2R3UT4+7hCLYILY757B2S6zJjnB/p2HR3MSMCbT1tZv9BV+5q:6XVYsAFlbBUx3MJWjBsM
TLSH T1FDE51227E9D8C07FD867B33291025AA1B94D0AF3D00560FF16FC0ABAC5859DB27617E6
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter GhostTypes
Tags:EtherHiding jar SilentNet stealer zip


Avatar
GhostTypes
SilentNet campaign - trojanized "Meteor Rejects" Minecraft addon served from meteorrejects.net (impersonates github.com/AntiCope/meteor-rejects). Rebuild of f72cecb7... (2026-09-08 sample) with re-randomized loader classes (com/github/sumCxpmtcsb, com/github/xcnFacade; Allatori-style kl_xor string decryption). C2: Polygon dead-drop contract 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a, function selector 0xce6d41de, 5-endpoint RPC rotation (polygon.drpc.org, polygon-bor-rpc.publicnode.com, 1rpc.io/matic, api.zan.top, quiknode). Distribution site un-proxied from Cloudflare on 2026-09-09 to evade a malware interstitial, now serving directly from Netlify (75.2.60.5). Sister landing meteorrejects.com (reg 2026-04-24, WebNic.cc) had its payload repo github.com/pizzabooxer/Meteor-Rejects terminated by GitHub 2026-09-13.

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Java.SuspAttach.96894448.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-debug masquerade obfuscated
Link:
https://www.filescan.io/uploads/6aa72cde07c5ea13a095d198/reports/208131e8-f14d-4784-85e9-3dbb3df18362/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/67d2cf32ba9cd0005efd57c1224360875c8c4ce69b8dec37af85c690c16c568e
Verdict:
Malicious
File Type:
jar
First seen:
2026-09-12T11:09:00Z UTC
Last seen:
2026-09-14T14:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/67d2cf32ba9cd0005efd57c1224360875c8c4ce69b8dec37af85c690c16c568e/results?tab=lookup
Score:
5%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/67d2cf32ba9cd0005efd57c1224360875c8c4ce69b8dec37af85c690c16c568e
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Elf Executable Executable PDB Path PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/4ace9833c0e88c6a7470fdd06a5b68d9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/67d2cf32ba9cd0005efd57c1224360875c8c4ce69b8dec37af85c690c16c568e/
Threat name:
Package.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-11 23:54:46 UTC
File Type:
Package (Java)
Extracted files:
927
AV detection:
3 of 38 (7.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m7jm6mv2ttiaaxx5k7aseq3aq5oiythgtog6yn5pqxdjbqlmk2ha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/67d2cf32ba9cd0005efd57c1224360875c8c4ce69b8dec37af85c690c16c568e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentNet

zip 67d2cf32ba9cd0005efd57c1224360875c8c4ce69b8dec37af85c690c16c568e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3916127/

Comments