🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b
SHA3-384 hash: fd91ae8b0dab53edcba6b061bd8938ced2ce3481d80ddfaa102f964c204c8fc7383987cec75360ad5dc5775ef2897f0d
SHA1 hash: 89245d0c5ef41af783ec76b661616842148094a9
MD5 hash: 650ca1974619ffc540fc107bf298feaf
humanhash: robert-alanine-winner-august
File name:a80369d59765adf2.bin
Download: download sample
File size:1'566'685 bytes
First seen:2026-10-05 21:25:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:K8ko7NsSDeiApAiF9UEOYlmgyzRdrtmKR0czPVmaf6JXgYdxWTq5zfPPn3RDQ8WK:z1ySCiApAU9ZcLtvR0EkaiJxdMO9P3D
TLSH T118753307556CA853FCB242B48B8D63EEC6C5700A0ED49A6B4D794631CD4FFD84A3C9BA
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter Tuxxin
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
US US
File Archive Information

This file archive contains 9 file(s), sorted by their relevance:

File name:MANIFEST.MF
File size:414 bytes
SHA256 hash: f20cbc7766cb9d9b3445c58e8402e9ec6da7454fa0ea62555939b6e56c8c2c0e
MD5 hash: bb6ee1fa6f1321a97516851800129f08
MIME type:text/plain
File name:en_us.json
File size:226 bytes
SHA256 hash: 6691204c334151adc8653b2d91acbf77fe28acc9254acd938bc1ff0872af518b
MD5 hash: 906dd91683991ec5d3870fa012aa5c76
MIME type:application/json
File name:github-mixin-loader-2.5.2-obfuscated.jar
File size:1'559'983 bytes
SHA256 hash: 0a12fe867fa13d409e829f958f63fd4937386fc4120587d7c08434d01323dc05
MD5 hash: f5547497837ea08637472a927d02f872
MIME type:application/java-archive
File name:GuiMixin.class
File size:3'323 bytes
SHA256 hash: 4ef2903224d60dd8870fe1cc86d969e88755609ad5302e90c276ab2ca756733a
MD5 hash: ebe2e51be2d02598868e842183850767
MIME type:application/x-java-applet
File name:icon.png
File size:6'312 bytes
SHA256 hash: 429b3cc4b15868de72a3aec6118b8e1a82fe84e56b6735095dc62fad6d5ec3c3
MD5 hash: 3c273febce9d9066b9a6e564ee71bf74
MIME type:image/png
File name:LICENSE_toggle-sprint-display
File size:7'815 bytes
SHA256 hash: f831e7eed577481687a9bc0b48024e5e40b6f655fcde073ede964b50be5d55d9
MD5 hash: cc46e3e9ef97cbdc56318ee7ff23d73e
MIME type:text/plain
File name:toggle-sprint-display.mixins.json
File size:279 bytes
SHA256 hash: 15f47095d52ae6659f685f26a8636942ce6b7c974359b81bf37b03c002e2f2b7
MD5 hash: baebace0977c87e578a3c457eb1985ba
MIME type:text/plain
File name:fabric.mod.json
File size:609 bytes
SHA256 hash: 28251d9543af7a6c2041b0d6835de799a02a192618e01f00094e123e3f44f053
MD5 hash: 1b2390fb1b69811268bfc4c33e9a738c
MIME type:text/plain
File name:toggle-sprint-display-refmap.json
File size:422 bytes
SHA256 hash: 5f15bffdb82561697b7c9beb33733c736ef4e9ac65238aa8b9f4db96f3880279
MD5 hash: 392de46494a37307bc662782de53512d
MIME type:application/json
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Java.SuspAttach.66997742.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac0b91059bf6e2f9e92ceb3
Tags:
n/a
Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b/results/dashboard
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6ac415d4d1f8d1e6f0612b27/reports/0da5de40-a13a-4951-a64d-db7972253d99/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b
Verdict:
Clean
File Type:
jar
First seen:
2026-09-28T13:30:00Z UTC
Last seen:
2026-09-30T13:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b/results?tab=lookup
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Zip Archive
Link:
https://app.malva.re/file/650ca1974619ffc540fc107bf298feaf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-18 18:41:54 UTC
File Type:
Binary (Archive)
Extracted files:
34
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vabwtvmxmww7eo5nhnvrrz7tzb7ffdtjlap7ndfuwv26r7qa4sfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ANDROID_Sample_Unique_2599c5a6
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:2599c5a6191bc208c4f0f1fcafba81b0f8d4099de6dc8d64ee7aec0b5289833e.jar
Rule name:JAVA_Malware_SilentNet_ForgeAuto_b44026bb_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects SilentNet (class, etat extrait)
Rule name:JAVA_Malware_Unknown_ForgeAuto_24ab100f
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_705fb75e
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_90eece6c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat extrait)
Rule name:JAVA_Malware_Unknown_ForgeAuto_bc333af1
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_6dc545a6
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_b2a4008d
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_PUA_ToggleSprintMod_MassSubmit
Create hunting rule
Author:Marjoriefort
Description:Mod Minecraft toggle-sprint-display (com.aeltumn) soumis en masse - pattern anormal + mixin-loader obfusque, PUA a confirmer
Reference:misses_archive 569 / grappe 39 archives identiques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip a80369d59765adf23bad3b6b18e7f3c87e528e69581ff68cb4b575e8fe00e48b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3917219/

Comments