MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf936fca40f4893c08fb2d63095c1efc4a77a934ec0348921c42c687a7cfd1aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SilentNet

Vendor detections: 4

Intelligence 4 IOCs YARA 11 File information Comments 1

SHA256 hash:	cf936fca40f4893c08fb2d63095c1efc4a77a934ec0348921c42c687a7cfd1aa
SHA3-384 hash:	892c5c98dce2135bb4226b7245915372e58c0f52c158918f3961a58b74d6e5d2a39a74f89ee58dfb9145f908331eb88f
SHA1 hash:	2ff6d50e36b0832f21e65b146f517859ac66695c
MD5 hash:	5a7796e7f283f7ddf5bc9c3609da1514
humanhash:	wisconsin-artist-muppet-aspen
File name:	krypton-client.top__Krypton-Client.jar.quarantined
Download:	download sample
Signature	SilentNet Create hunting rule
File size:	65'898 bytes
First seen:	2026-10-26 14:24:38 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1536:bjnqwdwaC2jpeVM3DkUWpBmP22UJP27uCxauvNovgzhB4JtvBR:PnqwSaC29Dl4T/ueMzA7
TLSH	T1725302163DCCCFDED85390B41AE5DCF596B5108EC695094A6A4C2C8C1BFBA4B9F02CE6
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	GhostTypes
Tags:	jar SilentNet zip

GhostTypes

SilentNet loader. File type: Minecraft Fabric mod (.jar). Source: https://krypton-client.top/ (a fake Minecraft client download site). The jar reads a Polygon contract (0x9c0a507300fd902787bb193d80fca5ce6e1bff9a) to get its C2 host. Campaign UUID (buyer ID): 87ceb2e7. Verdict: static analysis with bbmmd. The sample was not executed.

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 10 file(s), sorted by their relevance:

File name:	tc_veprg.class
File size:	54'619 bytes
SHA256 hash:	3e2c25225952803b1500d5a028e0fe04b1f4bdf525316a573056c9a19a8ce665
MD5 hash:	35b4a84f31021eb943b3ac56b34bb067
MIME type:	application/x-java-applet
Signature	SilentNet

File name:	MANIFEST.MF
File size:	449 bytes
SHA256 hash:	e23458c763e6e59ad3391c5cbd28145f6ae8fa59dd36fa3968b0621ba6f647f9
MD5 hash:	d072ec2e96d5b7f7de807b262cee032e
MIME type:	text/plain
Signature	SilentNet

File name:	loadJxlrr.class
File size:	7'499 bytes
SHA256 hash:	7eaf94c288624cf9c11735d3d6c204ca3b7fe40f091e3647500da09e2546d307
MD5 hash:	1879ef35c79b6ed2a79dff832653c4bf
MIME type:	application/x-java-applet
Signature	SilentNet

File name:	citnbhrAnzekBpobg.class
File size:	23'152 bytes
SHA256 hash:	98eb6820d145b2925e18b653ee3ad8d5ed440c2321b7896375c4abcb24c0d6df
MD5 hash:	d4195345c1c6f5f22de33cf5aab9c0c9
MIME type:	application/x-java-applet
Signature	SilentNet

File name:	citnbhrAnzekBpobg$rwbyx.class
File size:	702 bytes
SHA256 hash:	0b98928bcfd193ca095d53f4bad2bdd0ec4027e0e54d1849b27e025daf79e56f
MD5 hash:	538f18fa357a010d92e8d6d4a45e09b4
MIME type:	application/x-java-applet
Signature	SilentNet

File name:	fabric.mod.json
File size:	211 bytes
SHA256 hash:	aad462b1b2a39dc29dc63215bae013d10146b22d77cf70968bd020c653734a1c
MD5 hash:	4111ddb5a3d051474f45403566980a19
MIME type:	application/json
Signature	SilentNet

File name:	toLngnxs.class
File size:	26'646 bytes
SHA256 hash:	e5c3fcb44923bd9e1d5de268ce4eaece31e448416130a3f805f312878932460c
MD5 hash:	f18488eb7decba192bd230cc3bef194b
MIME type:	application/x-java-applet
Signature	SilentNet

File name:	kjatuvbCache.class
File size:	12'066 bytes
SHA256 hash:	b9656191b7376d47e21fba5f9174b1875befe6c7feacfbb40e6aa6de0bf853a0
MD5 hash:	0585e2646317182ce436f64b53faa6ee
MIME type:	application/x-java-applet
Signature	SilentNet

File name:	citnbhrAnzekBpobg$gfcsIdx.class
File size:	990 bytes
SHA256 hash:	50c48026b601d62026403874c81dd93154245eec5bf4f3e2e9a218e023e1ec60
MD5 hash:	59d1aaced207cd369a6ef38a1cb9d0d0
MIME type:	application/x-java-applet
Signature	SilentNet

File name:	citnbhrAnzekBpobg$rlij_hwlhs_dixy_kxtjff.class
File size:	1'428 bytes
SHA256 hash:	a95c5a0f533add22dfa8fde50e042ef589623474658dfc9b566a1681562ba72b
MD5 hash:	5e23435a57da6c64938621b1b18b18f7
MIME type:	application/x-java-applet
Signature	SilentNet

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.81869917.16879852.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6adf62deafb06e650cd93546

Tags:

n/a

Result

Verdict:

Malicious

File Type:

ZIP File

Link:

https://app.docguard.net/cf936fca40f4893c08fb2d63095c1efc4a77a934ec0348921c42c687a7cfd1aa/results/dashboard

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6adf62cd8cdd4e3191ace0c2/reports/c52256e0-fdb6-466d-aa78-1af833f1811c/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/cf936fca40f4893c08fb2d63095c1efc4a77a934ec0348921c42c687a7cfd1aa

Verdict:

Unknown

File Type:

jar

Link:

https://opentip.kaspersky.com/cf936fca40f4893c08fb2d63095c1efc4a77a934ec0348921c42c687a7cfd1aa/results?tab=lookup

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261026-salx7aew9v/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/cf936fca40f4893c08fb2d63095c1efc4a77a934ec0348921c42c687a7cfd1aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	JAVA_Malware_Unknown_ForgeAuto_03a7ca91 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_0ece8eba Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_1fde0fe5 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_50b45f1d Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_5888acd8 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	JAVA_Malware_Unknown_ForgeAuto_61773a0a Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (class, etat binaire)

Rule name:	SilentNet_CharArith_Obfuscation Create hunting rule
Author:	NyxIndius
Description:	Detects Java class with char-arithmetic string obfuscation (ldc/sipush A - B, isub, i2c) in volume

Rule name:	SilentNet_FakeFabric_Jar_Container Create hunting rule
Author:	NyxIndius
Description:	Detects fake Fabric mod JAR with net/fabric/ package (not net/fabricmc/) and random class names, associated with SilentNet loader/stealer

Rule name:	SilentNet_FakeFabric_Metadata Create hunting rule
Author:	NyxIndius
Description:	Detects MANIFEST or fabric.mod.json pointing to a net.fabric.* entrypoint (fake Fabric mod, SilentNet)

Rule name:	SilentNet_FakeFabric_Mod_Jar Create hunting rule
Author:	NyxIndius
Description:	Detects SilentNet Minecraft stealer fake Fabric mod JAR: fabric.mod.json plus random-named classes directly under com/github/ or net/fabric/ (incl. inner classes), without net/fabricmc/

Rule name:	SilentNet_Loader_Class Create hunting rule
Author:	NyxIndius
Description:	Detects SilentNet Java loader/stealer class: char-arith obfuscation plus launcher, dropper, custom HTTPS/DoH client or Minecraft session reflection

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SilentNet

zip cf936fca40f4893c08fb2d63095c1efc4a77a934ec0348921c42c687a7cfd1aa

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

GhostTypes commented on 2026-10-26 14:24:43 UTC