🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebbf5c58f9fe5d1018a6e30f40ae0e2035b75edb8ea19741d7f2c5a814002b6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Bombay


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebbf5c58f9fe5d1018a6e30f40ae0e2035b75edb8ea19741d7f2c5a814002b6e
SHA3-384 hash: 0382c45415e8f8737d585d27a07e3396a512cb22309bbea5203ce8afbee7fe412cd6823ee2df167f2a1ffd944bb128bf
SHA1 hash: 25fb6c6e53a936306adc33a6ebc6a407b83bcd20
MD5 hash: 3f323507f12fda4d9dde95ad07144fea
humanhash: bravo-montana-zebra-bluebird
File name:niggerclient.jar
Download: download sample
Signature Bombay
Create hunting rule
File size:3'183'035 bytes
First seen:2026-11-10 17:12:07 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 49152:adBC3DhiVp5RciFgsSa88Xrg8CFrDQ2h5+bLyoyHKa7yJ3z9ylYOHxK0JsDv:adBCzYsUQHHNyzylYqxK0GDv
TLSH T143E53320625BA87BC44925854817EC27FDFDB514DA069AEE73502DE03936BCF0B742BE
TrID 57.8% (.JAR) Minecraft Fabric Mod (24020/2/4)
32.5% (.JAR) Java Archive (13500/1/2)
9.6% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter ButDoge
Tags:bombay jar

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
BR BR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
niggerclient.jar
Verdict:
No threats detected
Analysis date:
2026-11-10 17:07:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1e72ab82-e06c-4af1-829a-8331c73799e5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99201/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af3506ee9782982f92ac214
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-debug obfuscated
Link:
https://www.filescan.io/uploads/6af350714832552147df619d/reports/e22b3fec-92e3-4f43-97cf-c638961b04c3/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/ebbf5c58f9fe5d1018a6e30f40ae0e2035b75edb8ea19741d7f2c5a814002b6e
Result
Malware family:
Bombay
Create hunting rule
Verdict:
Malicious
Trusted hash?:
False
File:
38
Classes:
35
Nested archives:
0
Source:
https://www.jarscanner.org/
Findings
Bombay signature: Bombay-associated Java loader: a method constructs and starts PowerShell to download and execute a script from tools.lumma.cy. The next-stage malware is not included in this identification.
PowerShell download and execution: The method constructs a PowerShell process with a remote download piped to Invoke-Expression and calls ProcessBuilder.start. The downloaded payload is not analyzed.
External process execution: ProcessBuilder can execute operating-system commands.
PowerShell execution: The file references PowerShell execution.
Verdict:
Malicious
File Type:
jar
Link:
https://opentip.kaspersky.com/ebbf5c58f9fe5d1018a6e30f40ae0e2035b75edb8ea19741d7f2c5a814002b6e/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/2003511
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2003511 Sample: niggerclient.jar Startdate: 10/11/2026 Architecture: WINDOWS Score: 56 12 Antivirus detection for URL or domain 2->12 14 Multi AV Scanner detection for submitted file 2->14 6 cmd.exe 1 2->6         started        process3 process4 8 java.exe 3 6->8         started        10 conhost.exe 6->10         started       
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/ebbf5c58f9fe5d1018a6e30f40ae0e2035b75edb8ea19741d7f2c5a814002b6e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebbf5c58f9fe5d1018a6e30f40ae0e2035b75edb8ea19741d7f2c5a814002b6e/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5o7vywhz7zoragfg4mhublqoea23oxw3r2qzoqox6lc2qfaafnxa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261110-vrmxxshb37/
Malware Family:
java
Create hunting rule
Malicious:
True
Tags:
jar process-rename debug-check env-check
Link:
https://intel.virussign.com/intelligence/file/ebbf5c58f9fe5d1018a6e30f40ae0e2035b75edb8ea19741d7f2c5a814002b6e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/ebbf5c58f9fe5d1018a6e30f40ae0e2035b75edb8ea19741d7f2c5a814002b6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:JAVA_Malware_NyxStealer_ForgeAuto_225d488c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects NyxStealer (class, etat extrait)
Rule name:JAVA_Malware_Unknown_ForgeAuto_205e30ee
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_8814e6c9
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_b2a4008d
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99201/

Comments