silentnet | Anubis Beta[.]jar

General

Target
Anubis Beta.jar
Size 20.3MB
Sample261108-yf4cbae17s
SHA256 27c92661e76e8c9c99c2868221a1170419698f5a264d8147e16b698cf88b8783
MD5 6a2bf3dc5576e019796b5446f7672d0c
SHA1 528e91a724e1e1c32b000149121fcfe0ea45fa16
SHA512 8a9a8b9f1cd426677db4330c3a2de090fb1c4aa5f7a4733b493d1367ff43997c9d0a6ea3e4c29a98b34c51ddb7171f027d5ae228a33b85d4ce9b5a61c83aff06
SSDEEP 393216:KUqzJYrAOBBwk0hVnXQupC4CTYV2nLsov+J1KOocZrlAlyLmrojhcR:CzJYrAOJ2VX5p70ubpocDAvUhs
TLSH
T1EA27330296AD717ADC3BA771C0114AA1AD3421C09A0BB44FBE7D078E4ED5E974F993EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Custom signature

Obfuscated class with Minecraft loader/stealer behavior 2 IoCs

Detects SilentNet Java loader/stealer: char-arith obfuscation plus launcher, dropper, custom HTTPS/DoH client or session reflection

resource	yara_rule
sample	SilentNet_Loader_Class
sample	SilentNet_Loader_Class_Variant

Custom signature

Detects references to legitimate web services potentially used as dead drop resolvers 1 IoCs

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

resource	yara_rule
sample	potential_ddr

Custom signature

Java class with char-arithmetic string obfuscation 1 IoCs

Detects Java bytecode with char-arithmetic string obfuscation (ldc/sipush A - B, isub, i2c)

resource	yara_rule
sample	SilentNet_CharArith_Obfuscation

Custom signature

Java class with char-arithmetic string decoding 1 IoCs

Detects Java bytecode with char-arithmetic string decoding (isub, i2c, castore/append)

resource	yara_rule
sample	SilentNet_CharArith_Obfuscation_Variant

Unsigned JAR 1 IoCs

Checks for missing JAR codesign signature.

resource
Anubis Beta.jar

SHA256 27c92661e76e8c9c99c2868221a1170419698f5a264d8147e16b698cf88b8783
MD5 6a2bf3dc5576e019796b5446f7672d0c
SHA1 528e91a724e1e1c32b000149121fcfe0ea45fa16
SHA512 8a9a8b9f1cd426677db4330c3a2de090fb1c4aa5f7a4733b493d1367ff43997c9d0a6ea3e4c29a98b34c51ddb7171f027d5ae228a33b85d4ce9b5a61c83aff06
SSDEEP 393216:KUqzJYrAOBBwk0hVnXQupC4CTYV2nLsov+J1KOocZrlAlyLmrojhcR:CzJYrAOJ2VX5p70ubpocDAvUhs
TLSH
T1EA27330296AD717ADC3BA771C0114AA1AD3421C09A0BB44FBE7D078E4ED5E974F993EC
MD5 SHA1 SHA512 SSDEEP TLSH

Obfuscated class with Minecraft loader/stealer behavior

Detects SilentNet Java loader/stealer: char-arith obfuscation plus launcher, dropper, custom HTTPS/DoH client or session reflection

loader stealer minecraft
Detects references to legitimate web services potentially used as dead drop resolvers

Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

network
Java class with char-arithmetic string obfuscation

Detects Java bytecode with char-arithmetic string obfuscation (ldc/sipush A - B, isub, i2c)

obfuscation
Java class with char-arithmetic string decoding

Detects Java bytecode with char-arithmetic string decoding (isub, i2c, castore/append)

obfuscation
Unsigned JAR

Checks for missing JAR codesign signature.