🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c23400bb65d1781e9b8f7ebb5f0daaa7d1ad5be1ca1bb2688d63f2d05c79c14a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c23400bb65d1781e9b8f7ebb5f0daaa7d1ad5be1ca1bb2688d63f2d05c79c14a
SHA3-384 hash: 4b6091e2e2da8a32cdc6494e0158ec6e7f5272f83b1ee9830eee0315577d7b8addc2ddf322f3eed91139f3118e5f8f26
SHA1 hash: c6df424ffdd1a1305a67c86ac6e362d1d4b036b3
MD5 hash: 03877dd343eb7e1d9b15d04a6cdd2c5e
humanhash: november-missouri-sodium-illinois
File name:syshelper.jar
Download: download sample
File size:5'075'332 bytes
First seen:2026-10-17 20:28:56 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 98304:jiRAMf7MbtG7HMMTIVAAdGqSFWT0jKC7sL/w9XvsNFHbpDBCTsgAMhYF:2R/f7MbtGIPzXCWTG30/whCR1lCTstkW
TLSH T1D136F117FED9D42DDA2344B350C28692647E96DCEC0B907F22E45E894A70C8A1752FFE
TrID 48.2% (.JAR) Java Archive (13500/1/2)
37.5% (.SH3D) Sweet Home 3D Design (generic) (10500/1/3)
14.2% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter smica83
Tags:jar

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
jar
Verdict:
Malicious activity
Analysis date:
2026-10-17 20:37:23 UTC
Tags:
ip-check evasion auto-reg discord
Link:
https://app.any.run/tasks/591019d0-4f78-4cc4-9a02-07cec5f98efb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/92417/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad3dae6f4e17c78f7163f16
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c23400bb65d1781e9b8f7ebb5f0daaa7d1ad5be1ca1bb2688d63f2d05c79c14a
Result
Malware family:
n/a
Verdict:
Malicious
Trusted hash?:
False
File:
2'702
Classes:
2'497
Nested archives:
0
Source:
https://www.jarscanner.org/
Findings
Blacklisted network destination: The file references a blacklisted host: api.ipify.org
PowerShell execution: The file references PowerShell execution.
Bundled native library: The archive contains a native library in a recognized dependency path.
User-Agent: May indicate outbound HTTP requests or client impersonation.
Native library loading: The class invokes a JVM API that loads platform-native code.
Verdict:
Malicious
File Type:
jar
First seen:
2026-10-17T18:11:00Z UTC
Last seen:
2026-10-18T18:04:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c23400bb65d1781e9b8f7ebb5f0daaa7d1ad5be1ca1bb2688d63f2d05c79c14a/results?tab=lookup
Result
Threat name:
KeyLogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1988439
Signature
Creates autostart registry keys to launch java
Exploit detected, runtime environment starts unknown processes
Installs a global keyboard hook
Java source code contains very large array initializations
Joe Sandbox ML detected suspicious sample
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Register Jar In Run Key
Sigma detected: Suspicious Processes Spawned by Java.EXE
Unusual module load detection (module proxying)
Yara detected Keylogger Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1988439 Sample: syshelper.jar Startdate: 17/10/2026 Architecture: WINDOWS Score: 92 87 discord.com 2->87 89 api.ipify.org 2->89 99 Yara detected Keylogger Generic 2->99 101 Sigma detected: Register Jar In Run Key 2->101 103 Sigma detected: Suspicious Processes Spawned by Java.EXE 2->103 105 6 other signatures 2->105 11 cmd.exe 1 2->11         started        13 javaw.exe 2->13         started        17 javaw.exe 2->17         started        signatures3 process4 file5 19 java.exe 18 11->19         started        23 conhost.exe 11->23         started        75 C:\Users\user\...\jna7876781166547716225.dll, PE32+ 13->75 dropped 109 Installs a global keyboard hook 13->109 26 powershell.exe 13->26         started        77 C:\Users\user\...\jna16840192832378968133.dll, PE32+ 17->77 dropped 28 powershell.exe 17->28         started        signatures6 process7 dnsIp8 91 api.ipify.org 172.67.74.152, 443, 49739, 49742 CLOUDFLARENET-CloudflareIncUS Canada 19->91 71 C:\Users\user\AppData\...\syshelper.jar, Java 19->71 dropped 30 javaw.exe 10 19->30         started        35 reg.exe 1 1 19->35         started        37 powershell.exe 25 19->37         started        107 Installs a global keyboard hook 23->107 39 csc.exe 26->39         started        41 conhost.exe 26->41         started        43 csc.exe 28->43         started        45 conhost.exe 28->45         started        file9 signatures10 process11 dnsIp12 93 discord.com 162.159.137.232, 443, 49744, 49746 CLOUDFLARENET-CloudflareIncUS Canada 30->93 79 C:\Users\user\...\jna6925723357088681611.dll, PE32+ 30->79 dropped 95 Installs a global keyboard hook 30->95 47 powershell.exe 30->47         started        97 Creates autostart registry keys to launch java 35->97 49 conhost.exe 35->49         started        81 C:\Users\user\AppData\...\anldrlad.cmdline, Unicode 37->81 dropped 51 csc.exe 37->51         started        54 conhost.exe 37->54         started        83 C:\Users\user\AppData\Local\...\5rklizru.dll, PE32 39->83 dropped 56 cvtres.exe 39->56         started        85 C:\Users\user\AppData\Local\...\r5vvmabq.dll, PE32 43->85 dropped 58 cvtres.exe 43->58         started        file13 signatures14 process15 file16 60 csc.exe 47->60         started        63 conhost.exe 47->63         started        69 C:\Users\user\AppData\Local\...\anldrlad.dll, PE32 51->69 dropped 65 cvtres.exe 51->65         started        process17 file18 73 C:\Users\user\AppData\Local\...\fkrh1c0e.dll, PE32 60->73 dropped 67 cvtres.exe 60->67         started        process19
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/c23400bb65d1781e9b8f7ebb5f0daaa7d1ad5be1ca1bb2688d63f2d05c79c14a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c23400bb65d1781e9b8f7ebb5f0daaa7d1ad5be1ca1bb2688d63f2d05c79c14a/
Threat name:
Package.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-17 18:48:23 UTC
File Type:
Package (Java)
Extracted files:
2702
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yi2abo3f2f4b5g4pp25v6dnku7i22w7bzin3e2enmpznaxdzyffa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/261017-y9n5gsc12w/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/92417/

Comments