MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2fe4f804a244b2f4847d383acbece0aef597af7cc3865e0fac7a96fb50521b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SilentNet

Vendor detections: 4

Intelligence 4 IOCs YARA 10 File information Comments

SHA256 hash:	b2fe4f804a244b2f4847d383acbece0aef597af7cc3865e0fac7a96fb50521b4
SHA3-384 hash:	c54c895d091899173b30d4d5a78aba21cf7eded7d5feaa90b87780987e06013ba1c73b18853bc617977060c3c676b7ac
SHA1 hash:	8aefa467106e7250084bf96a556868c013ef1325
MD5 hash:	2a394c6e708ea64131e01f44029c3337
humanhash:	michigan-michigan-florida-thirteen
File name:	doomsday-1.21-1.21.11.jar
Download:	download sample
Signature	SilentNet Create hunting rule
File size:	3'146'655 bytes
First seen:	2026-09-28 12:22:50 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	49152:0mEZAitMtgHFXl32NjN5C6Zjb4dKG7gfs+oqxz2UKHVgZlfJA/T6WZZxZO93aIr:0j5ENHCxBgzhxJZi7hZuV
TLSH	T1ABE53390F2F98703E25364B68587C0D394956BC7E6250ACE49F737EA1CE67BCAC9084D
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	C0RSA
Tags:	doomsday EtherHiding jar java SilentNet

C0RSA

silentnet-family Minecraft stealer. Doomsday client repack.
Campaign tag: e00db386-ab62-4dc1-91fd-21ef9ff3e6ef (shared with Krypton-Loader
and LuminexBeta samples). Distributed via "Cracked Clients" Discord
(ID 1510591182260928602).

Steals MC session (username, UUID, accessToken) -> POST /shard/prefireMc,
then PNG-stego second stage (/cdn/v2/9f4e7a2c1b8d.png) -> portable Python -> main.py.
C2 via Polygon contract 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a
(selector 0xce6d41de) -> thisisafalsepositive[.]st (DDoS-Guard). DoH via 1.1.1.1.
Injected classes share names with the Luminex sample but differ at byte level.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

jar

Verdict:

No threats detected

Analysis date:

2026-09-28 12:56:13 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c0f7f51a-f268-4cc7-acc6-1a39d8bfb776

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89427/

Detection(s):

SecuriteInfo.com.Trojan.Java.Agent.22562.18868.UNOFFICIAL

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug obfuscated

Link:

https://www.filescan.io/uploads/6aba62fd24dada380066f87f/reports/2cb9e0b4-659f-4368-aaf1-574a3d0b8eca/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b2fe4f804a244b2f4847d383acbece0aef597af7cc3865e0fac7a96fb50521b4

Verdict:

Malicious

File Type:

jar

First seen:

2026-09-28T11:01:00Z UTC

Last seen:

2026-09-28T11:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b2fe4f804a244b2f4847d383acbece0aef597af7cc3865e0fac7a96fb50521b4/results?tab=lookup

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260928-p36lhsvt6q/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/b2fe4f804a244b2f4847d383acbece0aef597af7cc3865e0fac7a96fb50521b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	JAVA_Malware_Unknown_ForgeAuto_03a7ca91 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_0ece8eba Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_1fde0fe5 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_50b45f1d Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_5888acd8 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_61773a0a Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_9790f193 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_be757529 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_f5701ef7 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	MULTI_Dropper_Unknown_GitHubObfuscated_JAR Create hunting rule
Author:	Marjoriefort
Description:	JAR dropper : classes obfusquees a noms random sous com/github/ (densite >= 4) - famille du resolver GitHub
Reference:	Veille glissante 2026-09-17_22 / grappe 21 JAR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentNet

jar b2fe4f804a244b2f4847d383acbece0aef597af7cc3865e0fac7a96fb50521b4

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/89427/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample