Overview

overview

10

Static

static

10

orchard-1....ed.jar

windows10-2004-x64

1

orchard-1....ed.jar

windows11-ltsc_2024-x64

1

Analysis

  • custom tags

    trojan dropper obfuscated

Sharing

Copy URL Twitter E-mail

General

  • Target
    orchard-1.21.11-patched.jar
  • Size 6.6MB
  • Sample261009-19rayswy9r
  • SHA256 bdf3d97ce0701673f88356033c405f28bb9644c15f4327809e7c0713a6e1eef1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
weedhacktrojan dropper obfuscated

Malware Config

Signatures

  • Family: Weedhack
    weedhack
  • Weedhack — Trojanized Fabric mod with IllI homoglyph obfuscation & UUID integrity table 1 IoCs

    Detects Weedhack Stage-1 trojanized Fabric mod JARs (e.g. NightSoul / CarpetTISFIX / OrbitalStrike campaign variants). Identifies the presence of the root [UUID].bin integrity database file combined with dense 'I' and 'l' homoglyph class naming in the ZIP directory table and Fabric metadata files.

    trojan dropper obfuscated
  • Unsigned JAR 1 IoCs

    Checks for missing JAR codesign signature.

File Explorer

  • orchard-1.21.11-patched.jar
    .jar 6.6MB

orchard-1.21.11-patched.jar

  • SHA256 bdf3d97ce0701673f88356033c405f28bb9644c15f4327809e7c0713a6e1eef1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  • Weedhack — Trojanized Fabric mod with IllI homoglyph obfuscation & UUID integrity table

    Detects Weedhack Stage-1 trojanized Fabric mod JARs (e.g. NightSoul / CarpetTISFIX / OrbitalStrike campaign variants). Identifies the presence of the root [UUID].bin integrity database file combined with dense 'I' and 'l' homoglyph class naming in the ZIP directory table and Fabric metadata files.

    trojan dropper obfuscated

  • Unsigned JAR

    Checks for missing JAR codesign signature.