MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7add757c3f09d52863fcc07948491ad967a7f0a9a51bbabb8567c26b8bfecfda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
SilentNet
Vendor detections: 2
| SHA256 hash: | 7add757c3f09d52863fcc07948491ad967a7f0a9a51bbabb8567c26b8bfecfda |
|---|---|
| SHA3-384 hash: | 0a5fc26b5367549828a228ec48ffb49724de4dbc18d94ab8664a1d41e305c3b73dc96b754fa95997d4533e061d8ed2ef |
| SHA1 hash: | ec3bbf65ffba1580c27f3b9ecd32a57ab3ad38a0 |
| MD5 hash: | 69e61c639608982e149af2a9a6572bcb |
| humanhash: | ink-two-chicken-comet |
| File name: | Anubis Beta 0.9.9.1-donutsmpclients-store.jar |
| Download: | download sample |
| Signature | SilentNet |
| File size: | 21'238'774 bytes |
| First seen: | 2026-10-22 15:00:40 UTC |
| Last seen: | Never |
| File type: | apk |
| MIME type: | application/vnd.android.package-archive |
| ssdeep | 393216:PUqzJYrAOBBwk0hVnXQupC4CTYV2nLsov+J1KOo/ZrlAlyLmrojhcq:PzJYrAOJ2VX5p70ubpo/DAvUhn |
| TLSH | T1FE27330296AD717EDC3BA771C0214AA16D3421C09A0BA44FBE7D078E4ED5E974F993EC |
| TrID | 46.1% (.JAR) Minecraft Fabric Mod (24020/2/4) 25.9% (.JAR) Java Archive (13500/1/2) 20.1% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3) 7.6% (.ZIP) ZIP compressed archive (4000/1) |
| Magika | jar |
| Reporter |  GhostTypes |
| Tags: | apk jar SilentNet stealer |
GhostTypes
SilentNet sn-loader-v3 fake Minecraft client jar (Anubis Beta 0.9.9.1 — IMPERSONATION of the legitimate paid Anubis client; the real Anubis is not affiliated), pulled 2026-10-22 from donutsmpclients.store (storefront front donutsmp-clients.com, domain reg 2026-10-13; reached via TikTok promo funnel). Static analysis (bbmmd): 1686 classes; allatori-interleave string encryption (307 decrypted strings); char-compose fold resolves C2 dead-drop contract 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (selector 0xce6d41de) read via 5-mirror Polygon RPC fleet (polygon.drpc.org, polygon-bor-rpc.publicnode.com, 1rpc.io/matic, api.zan.top, rpc-mainnet.matic.quiknode.pro); on-chain fallback thisisafalsepositive.st; beacon path /shard/prefireMc; campaign-uuid 8c06a480-a016-4da6-9a44-b6d6bfaf1a68; persistence markers 'install Microsoft' / 'install NtProfileIndex'. Kit fingerprints: dropper-g1:char-dense, sn-loader-v3:char-compose. Same contract+UUID across all nine storefront jars (sibling Goobaa 11e4d3ce… already on MB by wok).Intelligence
File Origin
GBVendor Threat Intelligence
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.