MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9e99b89d9c17fa8068cd214854e053f1f29e87f8e1a8f0dff4f3c52f60ea3b10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 9e99b89d9c17fa8068cd214854e053f1f29e87f8e1a8f0dff4f3c52f60ea3b10 |
|---|---|
| SHA3-384 hash: | 703f567d6a513597642db159ed54723377509d332ee1a8e388ea1baf88ad2680e45d1b248566b3443cc94c02677cac18 |
| SHA1 hash: | 336b8694b9901e369325ac378b4b96943f6d83df |
| MD5 hash: | 7b52a7c434bc54d73979dd11eb6221d8 |
| humanhash: | stairway-ten-lake-four |
| File name: | services.jar |
| Download: | download sample |
| File size: | 11'778'683 bytes |
| First seen: | 2026-10-09 22:43:15 UTC |
| Last seen: | Never |
| File type: |  jar |
| MIME type: | application/zip |
| ssdeep | 196608:PYQvld67oyoLnVgDqOsc/J7W6tBBJLs93VaKT4Yw+3oAWa+08XWuCqyjZU8V03a4:vld67oy4nqWWZW6vs93XTaGC08bCqC6J |
| TLSH | T126C6121358CA8929D97761F351C26E636C3E13DBE80B902F47F049D55BB398A4B12FE8 |
| TrID | 77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1) |
| Magika | jar |
| Reporter |  chrono |
| Tags: | discord jar java MicroStealer RAT stealer |
chrono
Micro Stealer payload ("Micro Special Edition"). Dropped by FruitzParty.exe to %LOCALAPPDATA%\java\services.jar and run via a bundled Temurin 17 JRE. Persists through the scheduled task App_<username>. Anti-VM checks (VBox/VMware/QEMU/Sandboxie drivers, Cuckoo/JoeBox pipes, wmic, tasklist). Steals Discord tokens and validates them via the API, browser history, Desktop/Documents files and a screenshot. Exfil to Discord webhook 1556790836333912135 and sa.microdenmem.workers.dev (now offline). C2 via Discord bot (guild 1554211553115512832) with 26 commands, including keylogger, mic recording, shell, file encryption and download-execute.Intelligence
File Origin
# of uploads :
1
# of downloads :
15
Origin country :
DEVendor Threat Intelligence
No detections
Detection:
n/a
Verdict:
Unknown
File Type:
jar
Score:
47%
Verdict:
Susipicious
File Type:
ARCHIVE
Gathering data
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
jar 9e99b89d9c17fa8068cd214854e053f1f29e87f8e1a8f0dff4f3c52f60ea3b10
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.Additional host/network indicators from static deobfuscation: mutex 'MicroPrivate-Mutex-Release'; lock file 'micro_run.lock'; file-encryption extension '.cryptedmicro' (commands !micro / !unmicro); persistence 'schtasks /create ... /sc ONLOGON /delay 0000:05 /rl HIGHEST'; multipart boundary 'xMicro'; User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) DiscordBot (Java/17)'; the licence id embedded in a/b/l.txt equals the path of the workers.dev /m/ URL listed on ThreatFox. Main-Class lIiiIiIlill.Iilllilliill.IIillIiliIil.liiiIIllIl.