🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5bc331ea79ba5d1a2792ec5ef3f4e790e2a3e426ad31e15800c3d81705503cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5bc331ea79ba5d1a2792ec5ef3f4e790e2a3e426ad31e15800c3d81705503cf
SHA3-384 hash: 5c9f31e8d842f9155cb9914acf22be22a767406b96fba86475d10b64ea49cd4b8665e553b1be48cf04c50b4e678b0a84
SHA1 hash: 400a5bb7ec3851cd8ea0198afc2c639a2de7dec9
MD5 hash: 78fb1a2c88f53c233228b6e934647c51
humanhash: burger-sweet-vegan-tango
File name:TaunahiLoader-26.2.jar
Download: download sample
File size:1'577'441 bytes
First seen:2026-09-20 13:17:48 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 49152:KfYoY+iQ5sGH9EDLtjCYO0WznduCBL3ds:SY+iGH9EDLtjCYfWRuqps
TLSH T142753306556CB813FCB352744B4DA3FA8AC5702A0D84997B5DBA53218D6FEC80F3C5BA
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika unknown
Reporter whack_sh
Tags:jar java zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
jar
Verdict:
No threats detected
Analysis date:
2026-09-20 13:22:02 UTC
Tags:
arch-exec
Link:
https://app.any.run/tasks/83a35f4e-c618-4fa4-9731-2692b46e574a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/87599/
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6aafdd1ed80b7cc6849436f8/reports/cd1da17f-a06c-484d-a76b-e18127d0430f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c5bc331ea79ba5d1a2792ec5ef3f4e790e2a3e426ad31e15800c3d81705503cf
Verdict:
Unknown
File Type:
jar
Link:
https://opentip.kaspersky.com/c5bc331ea79ba5d1a2792ec5ef3f4e790e2a3e426ad31e15800c3d81705503cf/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1975311
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1975311 Sample: TaunahiLoader-26.2.jar Startdate: 20/09/2026 Architecture: WINDOWS Score: 48 12 Multi AV Scanner detection for submitted file 2->12 6 cmd.exe 1 2->6         started        process3 process4 8 java.exe 3 6->8         started        10 conhost.exe 6->10         started       
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/c5bc331ea79ba5d1a2792ec5ef3f4e790e2a3e426ad31e15800c3d81705503cf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5bc331ea79ba5d1a2792ec5ef3f4e790e2a3e426ad31e15800c3d81705503cf/
Threat name:
ByteCode-JAVA.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-16 09:46:47 UTC
File Type:
Binary (Archive)
Extracted files:
44
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yw6dghvhtos5ditzf3c66p2opehcupscnljr4fmabq6yc4cvaphq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260920-qj3k7abg34/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/c5bc331ea79ba5d1a2792ec5ef3f4e790e2a3e426ad31e15800c3d81705503cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ANDROID_Sample_Unique_2599c5a6
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:2599c5a6191bc208c4f0f1fcafba81b0f8d4099de6dc8d64ee7aec0b5289833e.jar
Rule name:MULTI_PUA_ToggleSprintMod_MassSubmit
Create hunting rule
Author:Marjoriefort
Description:Mod Minecraft toggle-sprint-display (com.aeltumn) soumis en masse - pattern anormal + mixin-loader obfusque, PUA a confirmer
Reference:misses_archive 569 / grappe 39 archives identiques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Java file jar c5bc331ea79ba5d1a2792ec5ef3f4e790e2a3e426ad31e15800c3d81705503cf

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3910247/
Cape
Cape
https://www.capesandbox.com/analysis/87599/

Comments