MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90808d2036e2faa7853caf32061bba3d7d0544e9fc679ca456eedc9d57ff8e34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SilentNet


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90808d2036e2faa7853caf32061bba3d7d0544e9fc679ca456eedc9d57ff8e34
SHA3-384 hash: 4b36f5f4463893be81cbd4a21c074ac1117c1bb7aaf9a8abb7d859ac73b66ae3a5da6868d256f75ebf279e2441ab19a8
SHA1 hash: 60f0065bb0c681e5a2a8fd4906b77b2b933cf38c
MD5 hash: 070bc1031abb060fe65ce8bd99c5b548
humanhash: don-sad-lamp-venus
File name:BedrockCalculator 1.21.11.jar
Download: download sample
Signature SilentNet
Create hunting rule
File size:113'022 bytes
First seen:2026-06-28 08:20:05 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 3072:n1/SnS26XMexFMiQfU1LcYXwOp+SMAvBM5TXMq:t2O6HU1/XwMMA5M5T8q
TLSH T11AB302BDCB8880ABE4776933EA7255CAFD70273518AF68C51D7120D50C8E99ABB0245F
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter burger
Tags:jar SilentNet

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
BedrockCalculator1.21.11.jar
Verdict:
Malicious activity
Analysis date:
2026-06-27 21:43:44 UTC
Tags:
silentnet stealer etherhiding python evasion arch-exec openssl tool arch-doc arch-scr
Link:
https://app.any.run/tasks/41585682-f017-49b1-af89-436ed9acee81

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72277/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a40441086bc95245bfa14c4
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a40d96c615901a67ef550c3/reports/4dde7be8-362f-41d6-96a2-67c70294a838/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/90808d2036e2faa7853caf32061bba3d7d0544e9fc679ca456eedc9d57ff8e34
Verdict:
Malicious
File Type:
jar
First seen:
2026-06-27T18:50:00Z UTC
Last seen:
2026-06-29T18:07:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Java.Generic
Link:
https://opentip.kaspersky.com/90808d2036e2faa7853caf32061bba3d7d0544e9fc679ca456eedc9d57ff8e34/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1934621
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Exploit detected, runtime environment starts unknown processes
Joe Sandbox ML detected suspicious sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1934621 Sample: BedrockCalculator 1.21.11.jar Startdate: 28/06/2026 Architecture: WINDOWS Score: 84 83 thisisafalsepositive.st 2->83 85 pypi.org 2->85 87 3 other IPs or domains 2->87 97 Suricata IDS alerts for network traffic 2->97 99 Exploit detected, runtime environment starts unknown processes 2->99 101 Unusual module load detection (module proxying) 2->101 103 2 other signatures 2->103 11 cmd.exe 1 2->11         started        signatures3 process4 process5 13 java.exe 5 11->13         started        15 conhost.exe 11->15         started        process6 17 javaw.exe 884 13->17         started        dnsIp7 77 150.136.141.142, 443, 49701 ORACLE-BMC-31898-OracleCorporationUS United States 17->77 79 198.178.224.35, 443, 49699, 49716 LATITUDE-SH-LatitudeshUS United States 17->79 81 thisisafalsepositive.st 185.178.208.191, 443, 49704, 49713 DDOS-GUARDRU Russia 17->81 45 C:\Users\user\AppData\Local\...\python.exe, PE32+ 17->45 dropped 47 C:\Users\user\AppData\Local\...\winsound.pyd, PE32+ 17->47 dropped 49 C:\Users\user\AppData\...\vcruntime140_1.dll, PE32+ 17->49 dropped 51 623 other files (none is malicious) 17->51 dropped 21 python.exe 213 17->21         started        file8 process9 dnsIp10 89 132.145.155.63, 443, 49718 ORACLE-BMC-31898-OracleCorporationUS United States 21->89 91 151.101.128.175, 443, 49730 FASTLY-FastlyIncUS Canada 21->91 93 3 other IPs or domains 21->93 53 C:\Users\user\AppData\...\tmp7jsvz9sf.tmp, PE32+ 21->53 dropped 55 C:\Users\user\AppData\Local\...\winsound.pyd, PE32+ 21->55 dropped 57 C:\Users\user\AppData\...\vcruntime140_1.dll, PE32+ 21->57 dropped 59 30 other files (none is malicious) 21->59 dropped 105 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->105 107 Tries to harvest and steal browser information (history, passwords, etc) 21->107 109 Writes to foreign memory regions 21->109 111 2 other signatures 21->111 26 python.exe 1088 21->26         started        30 pip.exe 21->30         started        32 conhost.exe 21->32         started        34 chrome.exe 21->34         started        file11 signatures12 process13 dnsIp14 95 dualstack.python.map.fastly.net 151.101.192.223, 443, 49741, 49749 FASTLY-FastlyIncUS Canada 26->95 69 C:\Users\user\AppData\Local\...\pip3.exe, PE32+ 26->69 dropped 71 C:\Users\user\AppData\Local\...\pip3.12.exe, PE32+ 26->71 dropped 73 C:\Users\user\AppData\Local\...\pip.exe, PE32+ 26->73 dropped 75 378 other files (none is malicious) 26->75 dropped 36 conhost.exe 26->36         started        38 cmd.exe 26->38         started        40 python.exe 30->40         started        43 conhost.exe 30->43         started        file15 process16 file17 61 95ad9cf1790ae51303...729f24d.body (copy), Python 40->61 dropped 63 750721289c257d7ef1...c2c8a0f.body (copy), Python 40->63 dropped 65 49583e7972e864a609...ef5e4e7.body (copy), Python 40->65 dropped 67 17 other files (none is malicious) 40->67 dropped
Score:
13%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/90808d2036e2faa7853caf32061bba3d7d0544e9fc679ca456eedc9d57ff8e34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90808d2036e2faa7853caf32061bba3d7d0544e9fc679ca456eedc9d57ff8e34/
Verdict:
Malicious
Threat:
Family.SILENTNET
Link:
https://tip.neiki.dev/file/90808d2036e2faa7853caf32061bba3d7d0544e9fc679ca456eedc9d57ff8e34
Threat name:
Win32.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-06-27 21:43:52 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=scai2ibw4l5kpbj4v4zamg52hv6qkrhj7rtzzjcw53oj2v77ry2a._file
Result
Malware family:
silentnet
Create hunting rule
Score:
  10/10
Tags:
family:silentnet stealer
Link:
https://tria.ge/reports/260628-j8v43sgt5n/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/90808d2036e2faa7853caf32061bba3d7d0544e9fc679ca456eedc9d57ff8e34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/72277/

Comments