🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa
SHA3-384 hash: 38267276bd33ef865f612892bced344a9e7fa801717fb4c13aa8acb7f4f5b7b24705c6d371285d16d0054853ecca9321
SHA1 hash: 3b4d5b1ea6f2aa814595d9a474db920e1e03e0cf
MD5 hash: 6c532fcb82b518d62504010bcce9bc5b
humanhash: quebec-mike-sixteen-avocado
File name:dupe-donutsmp-26.2-35.jar
Download: download sample
File size:5'111'185 bytes
First seen:2026-10-09 21:23:33 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 98304:rTKYYRKwj4IFrULTQlWgHEqGqmOSBjua2SKrd1EJGPM0TKXf8kI:roRV4IOXKlV0jua25EJkbTxV
TLSH T1A8360210AF9D4035F413EB37A042F0A5B4BBEE69521BF4673A79054D582DE818B3FD8A
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter wok
Tags:funrat jar java RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
dupe-donutsmp-26.2-35.jar
Verdict:
Malicious activity
Analysis date:
2026-10-09 20:54:45 UTC
Tags:
arch-doc
Link:
https://app.any.run/tasks/d71791d6-b6d9-435a-b369-2d686f789941

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91268/
Detection(s):
SecuriteInfo.com.Java.SuspAttach.55145785.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug explorer lolbin obfuscated
Link:
https://www.filescan.io/uploads/6ac95b87ee79758441acd388/reports/06407ae3-7db9-4d67-a07d-c37b92ef9686/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa
Verdict:
Unknown
File Type:
jar
Link:
https://opentip.kaspersky.com/f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa/results?tab=lookup
Score:
13%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-09 21:24:18 UTC
File Type:
Binary (Archive)
Extracted files:
2522
AV detection:
4 of 38 (10.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6q6ygc75cvzg5bylerm7e2o3hp6h3nqbx6dmycury7fsomrtd2va._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261009-z85lhsws8k/
Behaviour
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_JAVA_JAR_Skidfuscator_Random_Runtime_Path_Oct26
Create hunting rule
Author:rc4
Description:Detects JAR files containing a class at a randomized 16+16 lowercase letter path as used for the runtime class of Skidfuscator 2.0.x community builds (heuristic, lower confidence)
Reference:https://github.com/skidfuscatordev/skidfuscator-java-obfuscator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Java file jar f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa

(this sample)

Java file jar be28f507fbaa4ae0b17b55d9ee9d9df63862a8530bf4cf49802d6bda53d35e40

  
Dropping
funrat
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/91268/
  
Dropping
SHA256 be28f507fbaa4ae0b17b55d9ee9d9df63862a8530bf4cf49802d6bda53d35e40
  
Dropping
MD5 bcf69c8fb9071da52268679eda8ab90e

Comments


Avatar
commented on 2026-10-09 21:57:40 UTC

Static analysis: fabric.mod.json registers core.Fun as an additional client initializer. It reads the Minecraft username, profile UUID and access token, then passes them to core.Coffe. Coffe downloads http://5kiwqdzvhip5yjx5u6ms2hsv3yozpslxocjhyf4cyimrg33fcb7devid.onion/api/hlam/files/4000, loads the response as a JAR in memory, and passes the session values to the payload class core.core. TorBridge reuses localhost:9050 or launches a local tor.exe. The payload URL was recovered from XOR-obfuscated strings.