MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d582d395bde7d7e3b2b0859b98ccd1a7a89f4dcfc9655805b2cd517ad5e6d01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	6d582d395bde7d7e3b2b0859b98ccd1a7a89f4dcfc9655805b2cd517ad5e6d01
SHA3-384 hash:	bb377615ea9e98b7c032cb703c84c8bda30379ae95827d0bcf478e677341827fceee259dd10eab392b63f43343de9856
SHA1 hash:	39305c85abca827065670bff00f7ff611f750ef9
MD5 hash:	b073966fa856bdef3727532f3a6c5824
humanhash:	oregon-oklahoma-indigo-colorado
File name:	RuneLite.jar
Download:	download sample
File size:	2'281'004 bytes
First seen:	2026-10-06 10:05:16 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	49152:rrIgvWsXyp9hKXD2evx+yHfJFmjywdcDPXMP2:rRvWsip9UxMM4TdcDPcu
TLSH	T1BEB5E057BAD8D87AEEBF8577522A4172B92F479CD00E602228B435D594E3D0D4F083EE
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	rc4
Tags:	jar java runelite runelure

rc4

Family: RuneLure. Trojanized RuneLite launcher served by alotic.net/dljar.php; RuneLure family; SHA-256 matches the prior reported case; captured 2026-10-06 UTC. Related infrastructure and full URL indicators are included in references.links. Static analysis only; samples were not executed.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

s2.bin

Verdict:

No threats detected

Analysis date:

2026-10-02 01:07:18 UTC

Tags:

arch-exec arch-doc attachments attc-unc evasion

Link:

https://app.any.run/tasks/4ee806a2-a686-46c8-b9e7-ee4e4fcbf7de

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90852/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad00636f4e17c78f7154992

Tags:

n/a

Verdict:

Unknown

Threat level:

0/10

Confidence:

100%

Tags:

anti-debug base64 macros-on-open obfuscated

Link:

https://www.filescan.io/uploads/6ac4c7e2eef72a83a9cb3f75/reports/7c1672ff-81f0-416c-9544-d9da3d819403/overview

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/6d582d395bde7d7e3b2b0859b98ccd1a7a89f4dcfc9655805b2cd517ad5e6d01

Verdict:

Unknown

File Type:

jar

Link:

https://opentip.kaspersky.com/6d582d395bde7d7e3b2b0859b98ccd1a7a89f4dcfc9655805b2cd517ad5e6d01/results?tab=lookup

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261006-l4nwbaxwgz/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/6d582d395bde7d7e3b2b0859b98ccd1a7a89f4dcfc9655805b2cd517ad5e6d01

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries