Threat LensFile scan report

Is FakeClientV3-1.21.11.jar safe?

Item: FakeClientV3-1.21.11.jar
Rating: 2.5
Author: MalwareTips File Scanner

55/100

Safety rating

Elevated risk

Verdict

Suspicious

Only Kaspersky flagged this JAR, but three offensive MITRE mappings create enough concern to avoid trusting it without stronger provenance.

Kaspersky alone flagged the file with a generic Java-trojan label, while the other participating engines provided no matching family consensus. One completed sandbox run did not issue a malicious verdict, but mappings to process injection, service manipulation, and defense impairment justify caution until the source and purpose are verified.

Do not open or run it until verified

Quarantine the JAR and verify its SHA-256 hash with the official publisher or release page before use. Keep endpoint protection enabled and avoid granting elevated permissions.

Read the full analysis

Saved file evidenceAntivirus consensus

1of 75 flagged

Flagged 1No detection 74

Digital specimenFakeClientV3-1.21.11.jar67f54309235f619660…328e4c38c5330c

Size404.3 KB

Code signingNot applicable

SandboxRuntime complete

First seen1mo ago

Evidence3 priority signals

1 high-confidence signature or behavior rule matched this file.

Before opening or running

Do not open or run it until the source and publisher can be verified independently.

If you already opened or ran it

Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from the publisher's official site and verify its exact hash when possible.

Chapter 02

Intelligence

The saved assessment, checked against the scan evidence and recorded coverage.

Analyst conclusion

Where this verdict could be wrong4 caveats

Kaspersky is a tier-1 engine and labeled the file HEUR:Trojan.Java.Generic, so its isolated detection cannot be dismissed as low-trust noise.
The runtime mapping includes T1055, T1543.002, and T1562.001, which can represent process injection, service manipulation, and defense impairment.
Although droppedChildren.hasMaliciousChild=false, all nine inspected child hashes have unknown verdicts rather than confirmed benign results.
contactedHosts=null, so no complete host-reputation result is available.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Recommended action

Quarantine the JAR and verify its SHA-256 hash with the official publisher or release page before use. Keep endpoint protection enabled and avoid granting elevated permissions.

Scan transparency

Coverage & freshness

4 of 5 complete

Complete means the check returned a usable result. It does not mean the file is safe.

Antivirus
Complete
1 of 75 engines flagged the file.
Updated Aug 25, 2026, 11:30 PM UTC
Sandbox
Complete
1 isolated runtime environment contributed observations.
Updated Sep 27, 2026, 7:27 AM UTC
Network
Not run
No contacted-host reputation check is recorded.
No timestamp recorded
YARA
Complete
1 signature or behavior rule matched.
Updated Sep 27, 2026, 7:27 AM UTC
External intel
Complete
3 of 3 independent reference sources completed.
Updated Sep 27, 2026, 7:27 AM UTC

Chapter 03

Behavior

Plain-English impact first, then the observed runtime evidence.

Runtime flight recorder

Capture complete

1isolated sandbox run
16MITRE ATT&CK techniques
15spawned processes
0network contacts
15filesystem & mutex artifacts

What this file does

Observed actions and their security significance

High concern: Injected code into another process, a technique that can conceal execution.
High concern: Created or modified a system service, which can keep code running.
High concern: Attempted to impair or bypass security controls.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Transferred a file over the network; malware can use this to fetch additional payloads.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Moderate concern: Checks which security software you have installed.

These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.

Recorded behavior

Attack story

Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.

ObservedDerived

Input file

The submitted object

FileObserved
FakeClientV3-1.21.11.jar
67f54309235f619660922bd936816b399e2cc04d4cfa08e914328e4c38c5330c
01Uploaded file

Processes

Runtime execution

ProcessObserved
Observed process
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
02Isolated runtime analysis
ProcessObserved
Observed process
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
03Isolated runtime analysis
+1 more recorded observation in Analyst mode

Files

Created or changed

Written fileObserved
2120
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2120
04Isolated runtime analysis
Written fileObserved
3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
05Isolated runtime analysis
+1 more recorded observation in Analyst mode

5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEAN·clean

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1055· Process injectionT1059· Runs commandsT1064T1074T1082· System reconT1105· Network file transferT1106T1129· Loads modulesT1202T1497· Sandbox evasionT1518.001· Checks your AVT1543.002· Service installT1562.001· Disables securityT1564· Hides artifactsT1564.001· Hides artifactsT1564.003· Hides artifacts

Spawned processes

$(unnamed)

"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"

$(unnamed)

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

$(unnamed)

C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"" >> C:\cmdlinestart.log 2>&1

$(unnamed)

C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

$(unnamed)

"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"

$(unnamed)

/bin/gzip

$(unnamed)

/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

$(unnamed)

/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart

+7 more processes captured.

Filesystem & mutexes

Files written13

C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2120
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
C:\Users\user\AppData\Local\Temp\hsperfdata_user
C:\Users\user\AppData\Local\Temp\hsperfdata_user\7164

+8 more

Files deleted2

C:\Users\user\AppData\Local\Temp\hsperfdata_user\1040
/tmp/hsperfdata_root/3566

Dropped payload

Files this sample writes at runtime

This file drops 9 children at runtime. None are currently flagged malicious in our cache.

9 unseen

df976e8647e306010e4e…54a633Never scanned
never seen before
63cf5c665697624b2442…662dd6Never scanned
never seen before
3ed31a43e26d9b9e119e…f81a8fNever scanned
never seen before
b29953117a8805dbc7ca…592c13Never scanned
never seen before
d87c5f3cdfb5b7c0510e…1ade9eNever scanned
never seen before
61625fd8b084f70f242d…55abd2Never scanned
never seen before
50c82f36208ed8040447…2d7843Never scanned
never seen before
8e8711854186c68e2368…4a3c7cNever scanned
never seen before
759aafcfa2395ce1b800…2af0f7Never scanned
never seen before

Chapter 04

Detection & Forensics

Consensus, attribution, signatures, code structure, prevalence, and identity.

RecordedObserved or authoritative facts

DerivedEvidence-backed analyst inferences

1rule hit recorded
1 / 75engines flagged
23sources in submission history

Evidence provenance

Why these facts are shown

Each statement identifies whether it was directly recorded or derived from saved scan facts.

01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapter
ProvenanceDerived
SourceSignature and behavior rules
Observed atSep 27, 2026, 7:27 AM UTC
02
1 of 75 antivirus engines flagged the file, including Kaspersky.
Verdict inputView chapter
ProvenanceObserved
SourceAntivirus analysis
Observed atAug 25, 2026, 11:30 PM UTC
03
The hash has been submitted 25 times from 23 sources.
View chapter
ProvenanceDerived
SourceSaved report facts
Observed atSep 27, 2026, 7:27 AM UTC
04
Scanned file: FakeClientV3-1.21.11.jar — 67f54309235f619660922bd936816b399e2cc04d4cfa08e914328e4c38c5330c
View chapter
ProvenanceObserved
SourceUploaded file
Observed atSep 27, 2026, 7:27 AM UTC
05
Observed process — "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atSep 27, 2026, 7:27 AM UTC
06
Observed process — C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atSep 27, 2026, 7:27 AM UTC
07
File written: 2120 — C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2120
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atSep 27, 2026, 7:27 AM UTC
08
File written: 3903daac9bc4a3b7.timestamp — C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
View chapter
ProvenanceObserved
SourceIsolated runtime analysis
Observed atSep 27, 2026, 7:27 AM UTC

Evidence map

Detection sources at a glance

4 completed · 0 unavailable

Antivirus

Threat match

1/75 flagged

Malware samples

No match

no match

Researcher rules

No match

no match

Reference software

No match

no match

Threat attribution

java

The available sources did not agree on a named threat category.

External intelligence

No researcher-database hits

MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.

Rule-based evidence

Signatures and behavior heuristics

A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
high
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"

Antivirus consensus

1 of 75 engines flagged this file

1 malicious0 suspicious74 not flagged

Tier-117 engines

1flagged

Tier-241 engines

0flagged

Low-trust17 engines

0flagged

Kasperskymalicious

HEUR:Trojan.Java.Generic

View all 75 engine results

KasperskyDET

AcronisOK

AhnLab-V3OK

AlibabaOK

alibabacloudOK

ALYacOK

Antiy-AVLOK

APEXtyp

ArcabitOK

AvastOK

Avast-MobileOK

AVGOK

AviraOK

BitDefenderOK

BitDefenderFalxtyp

BkavOK

CAT-QuickHealOK

ClamAVOK

CMCOK

CrowdStrikeOK

CTXOK

Cylancetyp

CynetOK

DeepInstincttyp

DrWebOK

Elastictyp

EmsisoftOK

ESET-NOD32OK

F-SecureOK

FortinetOK

GDataOK

GoogleOK

GridinsoftOK

huorongOK

IkarusOK

JiangminOK

K7AntiVirusOK

K7GWOK

KingsoftOK

LionicOK

MalwarebytesOK

MaxSecureOK

McAfeeDOK

MicrosoftOK

MicroWorld-eScanOK

NANO-AntivirusOK

Paloaltotyp

PandaOK

RisingOK

SangforOK

SentinelOneOK

SkyhighOK

SophosOK

SUPERAntiSpywareOK

SymantecOK

SymantecMobileInsighttyp

TACHYONOK

tehtristyp

TencentOK

Trapminetyp

TrellixENSOK

TrendMicroOK

TrendMicro-HouseCallOK

Trustlookfai

VaristOK

VBA32OK

VIPREOK

VirITOK

ViRobotOK

WebrootOK

XcitiumOK

YandexOK

ZillyaOK

ZoneAlarmOK

ZonerOK

PE structure

Not applicable

PE structure analysis applies to Windows executable formats, not this file type.

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

Moderate upload volume.

Total submissions

Includes repeat uploads by the same source.

First seen

1mo ago

Aug 25, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

File identity

Fingerprint and provenance

File name: FakeClientV3-1.21.11.jar
Format: JAR
Code signing: Not applicable to this file type
Size: 404.3 KB
Last analyzed: Sep 27, 2026, 7:27 AM UTC

SHA-256

67f54309235f619660922bd936816b399e2cc04d4cfa08e914328e4c38c5330c

Chapter 05

Safety & FAQ

Complete recovery guidance and answers for the next decision.

What to do now

We couldn't fully clear this file. Treat it with caution.

Recovery step 01
Don't open or run it unless you're certain it came from a source you trust.
Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
Recovery step 03
If its origin cannot be confirmed, delete this Java file and use a fresh copy from a trusted source. Get a fresh copy from the publisher's official site and verify its exact hash when possible.
Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.

Safety FAQ

Direct answers grounded in the saved verdict and evidence in this report.

7 evidence-based answers

Is FakeClientV3-1.21.11.jar safe, or is it malware?

Evidence-based answer

FakeClientV3-1.21.11.jar is suspicious — treat it as unsafe until you're sure. 1 of 75 antivirus engines flag it; that detection signal contributes to the cautious verdict. Don't open or run it unless you fully trust where it came from. Get a fresh copy from the publisher's official site and verify its exact hash when possible.

What is FakeClientV3-1.21.11.jar?

Evidence-based answer

FakeClientV3-1.21.11.jar is a Java application or archive, about 404 KB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.

How many antivirus engines detected FakeClientV3-1.21.11.jar?

Evidence-based answer

1 of 75 antivirus engines flagged FakeClientV3-1.21.11.jar, 1 of them as outright malicious. The raw count alone does not establish safety or danger; we also weigh which engines flagged it and corroborating behavior, identity, reputation, and rule evidence.

What should I do if I already opened or ran FakeClientV3-1.21.11.jar?

Evidence-based answer

Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.

How do I remove FakeClientV3-1.21.11.jar?

Evidence-based answer

To remove FakeClientV3-1.21.11.jar: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete this Java file from the device, then empty the Recycle Bin or Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.

What is the SHA-256 hash of FakeClientV3-1.21.11.jar?

Evidence-based answer

The SHA-256 hash of FakeClientV3-1.21.11.jar is 67f54309235f619660922bd936816b399e2cc04d4cfa08e914328e4c38c5330c, and its MD5 is 0322a87f70713d24f4e449b8003e6363. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

How up to date is this analysis of FakeClientV3-1.21.11.jar?

Evidence-based answer

This report reflects the scan run on September 27, 2026. Because a file's hash never changes, the identity of FakeClientV3-1.21.11.jar is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is FakeClientV3-1.21.11.jar safe?

Only Kaspersky flagged this JAR, but three offensive MITRE mappings create enough concern to avoid trusting it without stronger provenance.

Recommended next actions

Before opening or running

If you already opened or ran it

What We Detected

Threat Behavior

What To Do Now

Coverage & freshness

Antivirus

Sandbox

Network

YARA

External intel

Runtime flight recorder

What this file does

Attack story

FakeClientV3-1.21.11.jar

Observed process

Observed process

2120

3903daac9bc4a3b7.timestamp

Why these facts are shown

Detection sources at a glance

PE structure

Fingerprint and provenance

What to do now