silentnet | 67-CLIENT-FUCKED-BY-KIRK-forceloader[.]jar | Triage™

Analysis

custom tags

obfuscationloaderstealerminecraft

Sharing

Copy URL Twitter E-mail

General

Target
67-CLIENT-FUCKED-BY-KIRK-forceloader.jar
Size 7.8MB
Sample261011-bft3batwas
SHA256 e7e40c6748811647eaed7e095d5aecb243b0b78bda9b026900057822557ee1ff
MD5 c3ee33fd24fd7dd864df6ab25e767919
SHA1 bfc7e018497cd54556c2305164136eb4ceb64fa6
SHA512 8089282c756d8bc9b9aa839c5f76eab8752d73304bad0462aaf573b689244a7be3332886f22a99e36740318abaa13274458bb78ba2ac370e5a86b4cbce25b591
SSDEEP 196608:3lKh5twTULgmF9oi8FxG1ckL8U86bk7H3wfpEZxtZfhyYz8U:1ufgmFd8pi8H6byH3wBQxtZfvz8U
TLSH
T1E78633AB0AFD7DA2FA33B33CEC4914331E779985604E94B9046598C360FAD560D0B5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

silentnet obfuscation loader stealer minecraft

Malware Config

Signatures

Family: SilentNet
silentnet

Obfuscated class with Minecraft loader/stealer behavior 1 IoCs

Detects SilentNet Java loader/stealer: char-arith decoding plus launcher, dropper, custom HTTPS/SNI client or session reflection

loader stealer minecraft

resource	yara_rule
sample	SilentNet_Loader_Class_Variant

Java class with char-arithmetic string decoding 1 IoCs

Detects Java bytecode with char-arithmetic string decoding (isub, i2c, castore/append)

resource	yara_rule
sample	SilentNet_CharArith_Obfuscation_Variant

Unsigned JAR 1 IoCs

Checks for missing JAR codesign signature.

resource
67-CLIENT-FUCKED-BY-KIRK-forceloader.jar

File Explorer

67-CLIENT-FUCKED-BY-KIRK-forceloader.jar

.jar 7.8MB

67-CLIENT-FUCKED-BY-KIRK-forceloader.jar

SHA256 e7e40c6748811647eaed7e095d5aecb243b0b78bda9b026900057822557ee1ff
MD5 c3ee33fd24fd7dd864df6ab25e767919
SHA1 bfc7e018497cd54556c2305164136eb4ceb64fa6
SHA512 8089282c756d8bc9b9aa839c5f76eab8752d73304bad0462aaf573b689244a7be3332886f22a99e36740318abaa13274458bb78ba2ac370e5a86b4cbce25b591
SSDEEP 196608:3lKh5twTULgmF9oi8FxG1ckL8U86bk7H3wfpEZxtZfhyYz8U:1ufgmFd8pi8H6byH3wBQxtZfvz8U
TLSH
T1E78633AB0AFD7DA2FA33B33CEC4914331E779985604E94B9046598C360FAD560D0B5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Obfuscated class with Minecraft loader/stealer behavior

Detects SilentNet Java loader/stealer: char-arith decoding plus launcher, dropper, custom HTTPS/SNI client or session reflection

loader stealer minecraft
Java class with char-arithmetic string decoding

Detects Java bytecode with char-arithmetic string decoding (isub, i2c, castore/append)

obfuscation
Unsigned JAR

Checks for missing JAR codesign signature.