weedhack | Krypton-Client-1[.]21[.]1[.]jar

General

Target
Krypton-Client-1.21.1.jar
Size 1.9MB
Sample260629-eak41adw5n
SHA256 7e5a40a34c2d7d20b0a1a25384f89a16f4cbf30d074cd1340503889216b97e51
MD5 5f055b4de6598188416740496492df1c
SHA1 73162a0a3e6564e9c06af827c3fd4c29982664ef
SHA512 bc09e256f57035d6adb2640c73bf32241bba21137d337ed220268d370263fc528a0fb1bf0031c30a58e84170257742248aa5b7538974d20dc4b671edc88db56d
SSDEEP 49152:HWzH0pljUrK+pLGBCgRozSOAu26qVaw2EC:HWzH0pljUrNKACOWNaw2f
TLSH
T1DF951207BE9C9438EC275178E604CA93746498DCE217E0236BF4CA9D0C65EE457C6BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects the Weedhack RAT family (Minecraft Fabric stealer/dropper) 1 IoCs

Minecraft Fabric mod that exfiltrates session tokens, downloads and executes payloads, and persists via hidden mechanisms.

resource	yara_rule
sample	Weedhack

Unsigned JAR 1 IoCs

Checks for missing JAR codesign signature.

resource
Krypton-Client-1.21.1.jar

SHA256 7e5a40a34c2d7d20b0a1a25384f89a16f4cbf30d074cd1340503889216b97e51
MD5 5f055b4de6598188416740496492df1c
SHA1 73162a0a3e6564e9c06af827c3fd4c29982664ef
SHA512 bc09e256f57035d6adb2640c73bf32241bba21137d337ed220268d370263fc528a0fb1bf0031c30a58e84170257742248aa5b7538974d20dc4b671edc88db56d
SSDEEP 49152:HWzH0pljUrK+pLGBCgRozSOAu26qVaw2EC:HWzH0pljUrNKACOWNaw2f
TLSH
T1DF951207BE9C9438EC275178E604CA93746498DCE217E0236BF4CA9D0C65EE457C6BEE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects the Weedhack RAT family (Minecraft Fabric stealer/dropper)

Minecraft Fabric mod that exfiltrates session tokens, downloads and executes payloads, and persists via hidden mechanisms.

stealer rat trojan
Unsigned JAR

Checks for missing JAR codesign signature.