🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b644a3cbe287b06c1c4cae93c6ecc55806dbbd1564d5b17f9ecc1ec2c4c9ab7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SilentNet


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b644a3cbe287b06c1c4cae93c6ecc55806dbbd1564d5b17f9ecc1ec2c4c9ab7b
SHA3-384 hash: 9a76e4893f935d096873f6893f400f0a69b35b800ee6953bd68f2c7b22e97da251c6636040f0bc0d1da703e741500e93
SHA1 hash: 90165c84cdb21f464e9a7c8337dd06c410bba3db
MD5 hash: 289848ab5f4c2d903f5afbf3861231ac
humanhash: cat-ten-artist-georgia
File name:Anubis Beta 0.9.9.1--.jar
Download: download sample
Signature SilentNet
Create hunting rule
File size:21'239'342 bytes
First seen:2026-10-19 15:08:28 UTC
Last seen:2026-10-22 15:31:38 UTC
File type:Java file jar
MIME type:application/vnd.android.package-archive
ssdeep 393216:3UqzJYrAOBBwk0hVnXQupC4CTYV2nLsov+J1KOotZrlAlyLmrojhc8:nzJYrAOJ2VX5p70ubpotDAvUhH
TLSH T1EF27330296AD717EDC3BA771C0214AA16D3421C09A0BB44FBE7D078E4E95E974F993EC
TrID 46.1% (.JAR) Minecraft Fabric Mod (24020/2/4)
25.9% (.JAR) Java Archive (13500/1/2)
20.1% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
7.6% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter wok
Tags:apk jar java Python SilentNet

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
RO RO
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
apk
Verdict:
No threats detected
Analysis date:
2026-10-19 15:14:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3edae680-db73-4c26-81f5-ab658ed51ec5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad700005a22ac805bd80ced
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
masquerade signed
Link:
https://www.filescan.io/uploads/6ad6329a5f4362a2a0174fa2/reports/2d8a9542-664a-42c2-8219-6f8efcf6dbee/overview
Result
Malware family:
Silentnet
Create hunting rule
Verdict:
Malicious
Trusted hash?:
False
File:
1'369
Classes:
1'248
Nested archives:
14
Source:
https://www.jarscanner.org/
Findings
Minecraft session theft indicators: Code associated with Minecraft session-token collection was found.
Silentnet signature: Known Silentnet data path was found.
Bundled native library: The archive contains code that runs outside the JVM sandbox.
External process execution: ProcessBuilder can execute operating-system commands.
User-Agent: May indicate outbound HTTP requests or client impersonation.
Native library loading: The class invokes a JVM API that loads platform-native code.
Verdict:
Unknown
File Type:
jar
Link:
https://opentip.kaspersky.com/b644a3cbe287b06c1c4cae93c6ecc55806dbbd1564d5b17f9ecc1ec2c4c9ab7b/results?tab=lookup
Score:
13%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/b644a3cbe287b06c1c4cae93c6ecc55806dbbd1564d5b17f9ecc1ec2c4c9ab7b
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzckhs7cq6ygyhcmv2j4n3gfladnxpivmtk3c746zqpmfrgjvn5q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261019-sjjt7acw8z/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/b644a3cbe287b06c1c4cae93c6ecc55806dbbd1564d5b17f9ecc1ec2c4c9ab7b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentNet

Java file jar b644a3cbe287b06c1c4cae93c6ecc55806dbbd1564d5b17f9ecc1ec2c4c9ab7b

(this sample)

  
Dropping
SilentNet
  
Delivery method
Distributed via web download

Comments