Is martinidupes-fixed-1.21.11 (1) (1).jar safe?
This file is confirmed SilentNet — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete this Java file from the device, then empty the Recycle Bin or Trash. Scan your system.
This file is confirmed SilentNet — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete this Java file from the device, then empty the Recycle Bin or Trash. Scan your system.
5c24cfe40fc856226b…fa413e4a7fe8dfRecommended next actions
Before opening or running
Do not open or run it. Delete this Java file from the device, then empty the Recycle Bin or Trash.
If you already opened or ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
Why this file is confirmed malware
The conclusion below is grounded in the recorded hash match and scan evidence.
This file is confirmed SilentNet — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete this Java file from the device, then empty the Recycle Bin or Trash. Scan your system.
This file is confirmed SilentNet — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete this Java file from the device, then empty the Recycle Bin or Trash. Scan your system. MalwareBazaar is a researcher-curated malware repository; hits there are ground-truth positives.
What We Detected
This file is confirmed SilentNet — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete this Java file from the device, then empty the Recycle Bin or Trash. Scan your system.
Threat Behavior
Refer to the SilentNet threat family for known tactics.
What To Do Now
Delete this Java file from the device, then empty the Recycle Bin or Trash. Scan your system with an up-to-date antivirus.
Where this verdict could be wrong1 caveat
- If this hash is a polymorphic-collision with a legitimate build, the MB label would be misleading — but MB curation makes this extremely rare.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- MalwareBazaar confirmed family: SilentNet
- Rule/signature: SilentNet
Delete this Java file from the device, then empty the Recycle Bin or Trash. Run a full-system antivirus scan.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete19 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial1 runtime contact was observed without a completed reputation cross-check.
YARA
Complete2 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 17MITRE ATT&CK techniques
- 15spawned processes
- 1network contacts
- 15filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Created or modified a system service, which can keep code running.
High concern: Attempted to impair or bypass security controls.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Transferred a file over the network; malware can use this to fetch additional payloads.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Moderate concern: Checks which security software you have installed.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How trojans work
A trojan disguises itself as something useful or harmless to trick you into running it. Once open, it does its real job in the background — anything from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
martinidupes-fixed-1.21.11 (1) (1).jar
5c24cfe40fc856226b4c12cf651ea7a8cd6f72b1579baf627bfa413e4a7fe8df
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
5380
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5380
04Isolated runtime analysis - Written fileObserved
3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
162.159.36.2
Contact observed during runtime.
06Isolated runtime analysis
6 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 162.159.36.2
- C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5380
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
- C:\Users\user\AppData\Local\Temp\hsperfdata_user
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\7080
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\1640
- /tmp/hsperfdata_root/3569
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache.
- d5564a31a87e3bf2a71d…cd3d0fNever scannednever seen before
- 1aa41423bcd19619a5da…6dc5efNever scannednever seen before
- 293a85f5ad0c10da1d21…667855Never scannednever seen before
- d87c5f3cdfb5b7c0510e…1ade9eNever scannednever seen before
- 61625fd8b084f70f242d…55abd2Never scannednever seen before
- 50c82f36208ed8040447…2d7843Never scannednever seen before
- 8e8711854186c68e2368…4a3c7cNever scannednever seen before
- 759aafcfa2395ce1b800…2af0f7Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 2rule hits recorded
- 19 / 75engines flagged
- 43sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
The hash is catalogued as SilentNet in a researcher malware database.
Verdict inputView chapterProvenanceObservedSourceResearcher malware databaseObserved at - 02
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 03
19 of 75 antivirus engines flagged the file, including Alibaba and alibabacloud.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 04
Scanned file: martinidupes-fixed-1.21.11 (1) (1).jar — 5c24cfe40fc856226b4c12cf651ea7a8cd6f72b1579baf627bfa413e4a7fe8df
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: 5380 — C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\5380
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: 3903daac9bc4a3b7.timestamp — C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: 162.159.36.2 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: generic-trojan
One or more independent reference databases matched this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\download.jar"The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence162.159.36.2
19 of 75 engines flagged this file
View all 75 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- martinidupes-fixed-1.21.11 (1) (1).jar
- Format
- JAR
- Code signing
- Not applicable to this file type
- Size
- 1.1 MB
- Last analyzed
- Sep 29, 2026, 8:47 AM UTC
5c24cfe40fc856226b4c12cf651ea7a8cd6f72b1579baf627bfa413e4a7fe8dfSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't open or run this Java file. Delete this Java file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already opened or ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Get a fresh copy from the publisher's official site and verify its exact hash when possible.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is martinidupes-fixed-1.21.11 (1) (1).jar a virus?
What is martinidupes-fixed-1.21.11 (1) (1).jar?
How many antivirus engines detected martinidupes-fixed-1.21.11 (1) (1).jar?
What should I do if I already opened or ran martinidupes-fixed-1.21.11 (1) (1).jar?
How do I remove martinidupes-fixed-1.21.11 (1) (1).jar?
What kind of malware is martinidupes-fixed-1.21.11 (1) (1).jar?
Has martinidupes-fixed-1.21.11 (1) (1).jar been seen before?
What is the SHA-256 hash of martinidupes-fixed-1.21.11 (1) (1).jar?
How up to date is this analysis of martinidupes-fixed-1.21.11 (1) (1).jar?
Community
Member reviews and reports for this exact file hash.