MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9af7b019d2eec68e5ac23de89013dcae5c850a60afcdb56fe6f7d782818f869e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | 9af7b019d2eec68e5ac23de89013dcae5c850a60afcdb56fe6f7d782818f869e |
|---|---|
| SHA3-384 hash: | 9651158ccd4c8f58de04ae28adf423df4000cb157566a9edacded35e17d99a70e3906b810e4dfb69ea218b9e4c2c13ec |
| SHA1 hash: | bb8ed75591b278468f4a73ea343c15c32bcfab25 |
| MD5 hash: | 02c0eaa619c3e84d84cfb4305db510f9 |
| humanhash: | pizza-romeo-asparagus-gee |
| File name: | stage2.jar |
| Download: | download sample |
| File size: | 63'482 bytes |
| First seen: | 2026-10-18 16:20:19 UTC |
| Last seen: | Never |
| File type: |  jar |
| MIME type: | application/java-archive |
| ssdeep | 1536:zGDo+j9ZDFM2H3ZP9hh5PwHFZBQB5t5doS2Tlu/L4Oaw2W:K08lFMqDH5OFZuTdoJTSPcW |
| TLSH | T1BC53E0F36222B450C537123045C58DF16F6491D0A79867CA57BD3D0729EBBC8BECA299 |
| TrID | 77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1) |
| Magika | jar |
| Reporter |  wok |
| Tags: | jar java korexnode |
Intelligence
File Origin
# of uploads :
1
# of downloads :
98
Origin country :
USVendor Threat Intelligence
No detections
Malware family:
teamviewer
ID:
1
File name:
stage2.jar
Verdict:
Malicious activity
Analysis date:
2026-10-18 16:13:58 UTC
Tags:
evasion stealer arch-exec teamviewer rmm-tool tightvnc ip-check discord
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Clean
Score:
89.3%
Tags:
n/a
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Verdict:
Clean
File Type:
jar
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Threat name:
Binary.Trojan.Generic
Status:
Suspicious
First seen:
2026-10-18 16:21:22 UTC
File Type:
Binary (Archive)
Extracted files:
35
AV detection:
3 of 24 (12.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
jar 9af7b019d2eec68e5ac23de89013dcae5c850a60afcdb56fe6f7d782818f869e
(this sample)
Dropping
korexnode
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.