Overview

overview

10

Static

static

10

Krypton-1....er.jar

windows10-2004-x64

1

Krypton-1....er.jar

windows11-ltsc_2024-x64

1

Analysis

  • custom tags

    stealerminecraftfabricloaderobfuscation

Sharing

Copy URL Twitter E-mail

General

  • Target
    Krypton-1.21.11-forceloader.jar
  • Size 5.7MB
  • Sample261017-zel73sgg89
  • SHA256 f4a23f42038fbebce8b84b545d1d149dd8093e8fc7eac13b075a5bd57b9b98c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
silentnetstealerminecraftfabricloaderobfuscation

Malware Config

Signatures

  • Family: SilentNet
    silentnet
  • Custom signature
    Obfuscated class with Minecraft loader/stealer behavior 2 IoCs

    Detects SilentNet Java loader/stealer: char-arith obfuscation plus launcher, dropper, custom HTTPS/DoH client or session reflection

    loaderstealerminecraft
  • Custom signature
    SilentNet fake Fabric mod (XOR-obfuscation era, 2026) 1 IoCs

    SilentNet stealer: fake Fabric mod JAR with com/github (or net/fabric) random-named classes + inner classes; or fabric.mod.json with com.github/net.fabric root entrypoint; or extracted class with XOR string decode + SNI/base64url/TrustManager markers

    stealerminecraftfabricloader
  • Custom signature
    Java class with char-arithmetic string obfuscation 1 IoCs

    Detects Java bytecode with char-arithmetic string obfuscation (ldc/sipush A - B, isub, i2c)

    obfuscation
  • Custom signature
    Java class with char-arithmetic string decoding 1 IoCs

    Detects Java bytecode with char-arithmetic string decoding (isub, i2c, castore/append)

    obfuscation
  • Unsigned JAR 1 IoCs

    Checks for missing JAR codesign signature.

File Explorer

  • Krypton-1.21.11-forceloader.jar
    .jar 5.7MB

Krypton-1.21.11-forceloader.jar

  • SHA256 f4a23f42038fbebce8b84b545d1d149dd8093e8fc7eac13b075a5bd57b9b98c8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  • Obfuscated class with Minecraft loader/stealer behavior

    Detects SilentNet Java loader/stealer: char-arith obfuscation plus launcher, dropper, custom HTTPS/DoH client or session reflection

    loaderstealerminecraft

  • SilentNet fake Fabric mod (XOR-obfuscation era, 2026)

    SilentNet stealer: fake Fabric mod JAR with com/github (or net/fabric) random-named classes + inner classes; or fabric.mod.json with com.github/net.fabric root entrypoint; or extracted class with XOR string decode + SNI/base64url/TrustManager markers

    stealerminecraftfabricloader

  • Java class with char-arithmetic string obfuscation

    Detects Java bytecode with char-arithmetic string obfuscation (ldc/sipush A - B, isub, i2c)

    obfuscation

  • Java class with char-arithmetic string decoding

    Detects Java bytecode with char-arithmetic string decoding (isub, i2c, castore/append)

    obfuscation

  • Unsigned JAR

    Checks for missing JAR codesign signature.