MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239
SHA3-384 hash:	e8192d5445e313f10dfef49f7ada8937324a76049184fe18a74a082e56e18ee7831bc6812014c058827b90a8abb77177
SHA1 hash:	014ed5d83aec857d19b262c2907fd54b6dd106d0
MD5 hash:	297f66f275200fa96b0df78e46d1758a
humanhash:	football-friend-earth-lamp
File name:	Ikov.jar
Download:	download sample
File size:	3'418'722 bytes
First seen:	2026-11-09 21:45:44 UTC
Last seen:	Never
File type:	jar
MIME type:	application/java-archive
ssdeep	98304:ibX4JHEdhbkMxzTN6OdGkVG78EaIR8M22W7p:y4xETbkgTNppVGQEJ5bWN
TLSH	T1AFF5E133AEDACA28DE7784B751C28642942E556AEC0B927E03D45D858B70D4B0373FF9
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	rc4
Tags:	jar runelure

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

https://ikovrsps.com/Ikov.jar

Verdict:

Malicious activity

Analysis date:

2026-11-09 21:35:33 UTC

Tags:

evasion ip-check ikovstealer stealer arch-doc

Link:

https://app.any.run/tasks/2a8763f9-abbb-498d-b681-0fe0121e618e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/98836/

Detection(s):

SecuriteInfo.com.Java.Trojan.GenericGB.29743.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af23f281492c978625a8d08

Tags:

java

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating synchronization primitives

Searching for synchronization primitives

Creating a file in the %AppData% subdirectories

Launching a process

Enabling the 'hidden' option for recently created files

Creating a file in the %temp% directory

Deleting a recently created file

DNS request

Sending a custom TCP request

Launching the process to interact with network services

Creating a file

Reading critical registry keys

Stealing user critical data

Enabling autorun by creating a file

Adding an exclusion to Microsoft Defender

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug obfuscated

Link:

https://www.filescan.io/uploads/6af23f2105f96049e0d5f32a/reports/3d544fee-05cc-4218-a7a3-f39c33459d4a/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239

Result

Malware family:

n/a

Verdict:

Suspicious

Trusted hash?:

False

File:

1'508

Classes:

1'450

Nested archives:

Source:

https://www.jarscanner.org/

Findings

External process execution: ProcessBuilder can execute operating-system commands.

PowerShell execution: The file references PowerShell execution.

Bundled native library: The archive contains a native library in a recognized dependency path.

Native library loading: The class invokes a JVM API that loads platform-native code.

Skidfuscator: A string matches a known obfuscator signature.

Verdict:

Malicious

File Type:

jar

Link:

https://opentip.kaspersky.com/7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239/results?tab=lookup

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2002286

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pwe3aaxzyf6eswcrvzsxl3rleio6674rc2uy2gldbdsm52kfui4q._file

Result

Malware family:

n/a

Score:

8/10

Tags:

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/261109-1mnljsey5x/

Behaviour

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Creates a file in the Startup directory

Executes dropped EXE

Unsecured Credentials: Credentials In Files

Command and Scripting Interpreter: PowerShell

Disables one or more Microsoft Defender components

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/7d89b002f9c17c495851ae6575ee2b221def7f9116a98d196308e4cee945a239

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	SUSP_JAVA_JAR_Skidfuscator_Random_Runtime_Path_Oct26 Create hunting rule
Author:	rc4
Description:	Detects JAR files containing a class at a randomized 16+16 lowercase letter path as used for the runtime class of Skidfuscator 2.0.x community builds (heuristic, lower confidence)
Reference:	https://github.com/skidfuscatordev/skidfuscator-java-obfuscator