MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments 2

SHA256 hash:	f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa
SHA3-384 hash:	38267276bd33ef865f612892bced344a9e7fa801717fb4c13aa8acb7f4f5b7b24705c6d371285d16d0054853ecca9321
SHA1 hash:	3b4d5b1ea6f2aa814595d9a474db920e1e03e0cf
MD5 hash:	6c532fcb82b518d62504010bcce9bc5b
humanhash:	quebec-mike-sixteen-avocado
File name:	dupe-donutsmp-26.2-35.jar
Download:	download sample
File size:	5'111'185 bytes
First seen:	2026-10-09 21:23:33 UTC
Last seen:	Never
File type:	jar
MIME type:	application/zip
ssdeep	98304:rTKYYRKwj4IFrULTQlWgHEqGqmOSBjua2SKrd1EJGPM0TKXf8kI:roRV4IOXKlV0jua25EJkbTxV
TLSH	T1A8360210AF9D4035F413EB37A042F0A5B4BBEE69521BF4673A79054D582DE818B3FD8A
TrID	77.1% (.JAR) Java Archive (13500/1/2) 22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika	jar
Reporter	wok
Tags:	funrat jar java RAT

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

dupe-donutsmp-26.2-35.jar

Verdict:

Malicious activity

Analysis date:

2026-10-09 20:54:45 UTC

Tags:

arch-doc

Link:

https://app.any.run/tasks/d71791d6-b6d9-435a-b369-2d686f789941

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91268/

Detection(s):

SecuriteInfo.com.Java.SuspAttach.55145785.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad09d656f551121ba15e7f8

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug explorer lolbin obfuscated

Link:

https://www.filescan.io/uploads/6ac95b87ee79758441acd388/reports/06407ae3-7db9-4d67-a07d-c37b92ef9686/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa

Result

Malware family:

n/a

Verdict:

Malicious

Trusted hash?:

False

File:

1'686

Classes:

1'565

Nested archives:

Source:

https://www.jarscanner.org/

Findings

Minecraft session theft indicators: Code associated with Minecraft session-token collection was found.

Blacklisted network destination: The file references a blacklisted host: tonapi.io

External process execution: ProcessBuilder can execute operating-system commands.

User-Agent: May indicate outbound HTTP requests or client impersonation.

Skidfuscator: A string matches a known obfuscator signature.

Verdict:

Unknown

File Type:

jar

Link:

https://opentip.kaspersky.com/f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa/results?tab=lookup

Score:

13%

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261009-z85lhsws8k/

Behaviour

Suspicious use of SetWindowsHookEx

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_JAVA_JAR_Skidfuscator_Random_Runtime_Path_Oct26 Create hunting rule
Author:	rc4
Description:	Detects JAR files containing a class at a randomized 16+16 lowercase letter path as used for the runtime class of Skidfuscator 2.0.x community builds (heuristic, lower confidence)
Reference:	https://github.com/skidfuscatordev/skidfuscator-java-obfuscator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

jar f43d830bfd15726e870b2459f269db3bfc7db601bf86cc0a91c7cb2732331eaa

(this sample)

jar be28f507fbaa4ae0b17b55d9ee9d9df63862a8530bf4cf49802d6bda53d35e40

Dropping

funrat

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/91268/

Dropping

SHA256 be28f507fbaa4ae0b17b55d9ee9d9df63862a8530bf4cf49802d6bda53d35e40

Dropping

MD5 bcf69c8fb9071da52268679eda8ab90e

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Daydream commented on 2026-10-17 16:45:21 UTC

FunRAT Stage-1 trojanized Meteor Client Fabric mod (dupe-donutsmp-26.2-35.jar, Skidfuscator). Entrypoint core.Fun + core.Probe extracts Minecraft session credentials with affiliate OWNER_KEY 346706a8-1a90-4d80-b003-c34b9b44c3b4, extracts embedded /tor/win/tor.exe (sha256 60c45b01938c799862e511a9a5bab12f959a819c6264a24502edc342165f570c) via core.TorBridge (127.0.0.1:9050), and downloads Stage-2 (4000.jar) in memory from http://5kiwqdzvhip5yjx5u6ms2hsv3yozpslxocjhyf4cyimrg33fcb7devid.onion/api/hlam/files/4000.

rc4 commented on 2026-10-09 21:57:40 UTC

Static analysis: fabric.mod.json registers core.Fun as an additional client initializer. It reads the Minecraft username, profile UUID and access token, then passes them to core.Coffe. Coffe downloads http://5kiwqdzvhip5yjx5u6ms2hsv3yozpslxocjhyf4cyimrg33fcb7devid.onion/api/hlam/files/4000, loads the response as a JAR in memory, and passes the session values to the payload class core.core. TorBridge reuses localhost:9050 or launches a local tor.exe. The payload URL was recovered from XOR-obfuscated strings.