MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988
SHA3-384 hash:	db64c5d1054baac22949ab0e220b99db6f0ac3fa70fb2dfa9a9f1056e11ff1521babb07b81046a0818542b85d95468b0
SHA1 hash:	3a355ab7f599feb8114609e8f80c511e1b8bc311
MD5 hash:	96d863519faac6913433b4ccdba08269
humanhash:	grey-enemy-sixteen-failed
File name:	7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988.jar
Download:	download sample
Signature	MaksRAT Alert Create hunting rule
File size:	32'941 bytes
First seen:	2025-12-10 07:07:22 UTC
Last seen:	Never
File type:	jar
MIME type:	application/java-archive
ssdeep	768:V9PqiEjfUZGFUVw2rVibJXzDOfCugB1S2Svf2nV9FLfGlQY8+eNsW:bUFUGtbJX3ECug+EhGlxriz
TLSH	T1B5E2F1E479574085EBD1A971E541C40B627E4B23B78AE732637CBEEA34603DAC8D0CB0
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	JAMESWT_WT
Tags:	foldacces-online jar maksrat

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

112

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN

Malware family:

n/a

ID:

1

File name:

_7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988.zip

Verdict:

No threats detected

Analysis date:

2025-12-10 07:09:18 UTC

Tags:

java

Link:

https://app.any.run/tasks/a21af9b2-1f9a-4dd6-9498-636e50a19b29

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/44085/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Java.Trojan.GenericGB.29743.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69391c38a675b653bd0f9de4

Tags:

virus java

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

jar

First seen:

2025-11-09T09:42:00Z UTC

Last seen:

2025-11-09T10:18:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Java.Alien.gen HEUR:Trojan-PSW.Java.Stealer.gen Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Pycoon.sb Trojan-PSW.Win32.Greedy.sb

Link:

https://opentip.kaspersky.com/7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988/

Neiki Trojan-PSW.Win32.Stealer

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.Stealer

Link:

https://tip.neiki.dev/file/7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988

ReversingLabs TitaniumCloud ByteCode-JAVA.Trojan.Generic

Threat name:

ByteCode-JAVA.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-11-09 05:55:47 UTC

File Type:

Binary (Archive)

Extracted files:

5

AV detection:

8 of 36 (22.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=orsoz54vzetcnz542bdejnukriiopvyz3bteadszc35to42apgea._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

credential_access defense_evasion discovery execution persistence stealer

Link:

https://tria.ge/reports/251210-hxvhqswla1/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Kills process with taskkill

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Browser Information Discovery

Drops file in Windows directory

Adds Run key to start application

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Uses browser remote debugging

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/44085/