silentnet | KryptonPlus-1[.]21[.]11[.]jar

General

Target
KryptonPlus-1.21.11.jar
Size 2.9MB
Sample261017-xp8gyscs3w
SHA256 7564375fc4de22673fabf0708a47f06a514fc2a430fd6c6b8f78af2e8b98d262
MD5 2b44fa08111c681093c770565138c795
SHA1 90c530e86e9b53b484a8bc5ead399dc5f173d58c
SHA512 a4873e14af1f732e0a346cdd29e1db7b1e4eadca856ef70c78614a3852cde5baad85195f19931255bef35954085f316878be8f8b08ed39a396e479a69826191a
SSDEEP 49152:SWtU08CSkaXHcneam8amqERrjC0urWPqsH/QUHUEGgrfhd2n5aez6pnUBztv8Zc2:8zCuX8nqEVC0Dq09GApw5XOMpv8itvk/
TLSH
T12DD5335F68AB4882F56F2CBD34956909711B80BE7CEB81382B795AC5D78DBCC8318613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Custom signature

Obfuscated class with Minecraft loader/stealer behavior 2 IoCs

Detects SilentNet Java loader/stealer: char-arith obfuscation plus launcher, dropper, custom HTTPS/DoH client or session reflection

resource	yara_rule
sample	SilentNet_Loader_Class
sample	SilentNet_Loader_Class_Variant

Custom signature

Fake Fabric mod JAR with net/fabric/ package and random class names 1 IoCs

Detects fake Fabric mod JAR (net/fabric/* random class names) associated with SilentNet loader/stealer

resource	yara_rule
sample	SilentNet_FakeFabric_Jar_Container

Custom signature

Java class with char-arithmetic string obfuscation 1 IoCs

Detects Java bytecode with char-arithmetic string obfuscation (ldc/sipush A - B, isub, i2c)

resource	yara_rule
sample	SilentNet_CharArith_Obfuscation

Custom signature

Java class with char-arithmetic string decoding 1 IoCs

Detects Java bytecode with char-arithmetic string decoding (isub, i2c, castore/append)

resource	yara_rule
sample	SilentNet_CharArith_Obfuscation_Variant

Unsigned JAR 1 IoCs

Checks for missing JAR codesign signature.

resource
KryptonPlus-1.21.11.jar

SHA256 7564375fc4de22673fabf0708a47f06a514fc2a430fd6c6b8f78af2e8b98d262
MD5 2b44fa08111c681093c770565138c795
SHA1 90c530e86e9b53b484a8bc5ead399dc5f173d58c
SHA512 a4873e14af1f732e0a346cdd29e1db7b1e4eadca856ef70c78614a3852cde5baad85195f19931255bef35954085f316878be8f8b08ed39a396e479a69826191a
SSDEEP 49152:SWtU08CSkaXHcneam8amqERrjC0urWPqsH/QUHUEGgrfhd2n5aez6pnUBztv8Zc2:8zCuX8nqEVC0Dq09GApw5XOMpv8itvk/
TLSH
T12DD5335F68AB4882F56F2CBD34956909711B80BE7CEB81382B795AC5D78DBCC8318613
MD5 SHA1 SHA512 SSDEEP TLSH

Obfuscated class with Minecraft loader/stealer behavior

Detects SilentNet Java loader/stealer: char-arith obfuscation plus launcher, dropper, custom HTTPS/DoH client or session reflection

loader stealer minecraft
Fake Fabric mod JAR with net/fabric/ package and random class names

Detects fake Fabric mod JAR (net/fabric/* random class names) associated with SilentNet loader/stealer

loader stealer
Java class with char-arithmetic string obfuscation

Detects Java bytecode with char-arithmetic string obfuscation (ldc/sipush A - B, isub, i2c)

obfuscation
Java class with char-arithmetic string decoding

Detects Java bytecode with char-arithmetic string decoding (isub, i2c, castore/append)

obfuscation
Unsigned JAR

Checks for missing JAR codesign signature.