Is KryptonPlus-leomannen112.jar safe?
Thirty-nine of 75 engines flagged this JAR, including ten tier-1 detections, while runtime evidence mapped activity to injection, persistence, and defense-impairment techniques.
The detection pattern is broad and high quality: 39 of 75 engines flagged the file, including ten tier-1 engines, with several identifying a Java dropper or MalwareX. A completed sandbox also mapped activity to T1055, T1543.002, and T1562.001, despite its overall clean label.
a7b387ec3a93164026…e4831a6bc59ffeRecommended next actions
Before opening or running
Do not open or run it. Delete this Java file from the device, then empty the Recycle Bin or Trash.
If you already opened or ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The detection pattern is broad and high quality: 39 of 75 engines flagged the file, including ten tier-1 engines, with several identifying a Java dropper or MalwareX. A completed sandbox also mapped activity to T1055, T1543.002, and T1562.001, despite its overall clean label.
The sample drew 39 detections from 75 engines, including ten tier-1 detections, which strongly exceeds a plausible isolated false-positive pattern. Several respected engines independently describe it as a Java dropper, and Avast, AVG, and Avira use the MalwareX name. Runtime evidence includes process injection, service-related persistence, and defense impairment mappings, adding behavioral support to the static detections. The single sandbox's overall clean label and the lack of a known-malicious contacted host are meaningful counter-signals, but they do not explain the broad engine response and offensive techniques. The five dropped files also remain unresolved rather than established as benign.
What We Detected
Thirty-nine of 75 antivirus engines flagged the JAR, including ten tier-1 engines. ESET-NOD32, F-Secure, Fortinet, and Ikarus identify Java dropper or downloader behavior, while Avast, AVG, and Avira associate it with MalwareX. Although only two engines form the recorded MalwareX family consensus, the overall tier-1 detection count provides strong independent support.
Threat Behavior
One completed sandbox run mapped activity to T1055 (Process Injection), T1543.002 (System Services: Systemd Service), and T1562.001 (Impair Defenses). Its overall sandbox label was clean, and the only observed domain, assets.msn.com, had no malicious or suspicious cache record. Five dropped files were inspected without a confirmed malicious child, but all five remain unclassified, so they cannot be treated as benign.
What To Do Now
Do not execute the JAR. Quarantine or remove it while keeping endpoint protection enabled, and inspect any system where it ran for unexpected Java processes, persistence changes, security-control interference, and the five dropped-file hashes.
Where this verdict could be wrong4 caveats
- behaviour.hasMaliciousSandboxVerdict=false: the single completed sandbox labeled its overall run clean despite recording three offensive techniques.
- contactedHosts.inspected=1 found no cached malicious or suspicious reputation for the only observed domain, assets.msn.com.
- droppedChildren.hasMaliciousChild=false, although all 5 inspected child hashes remain without a verdict.
- externalIntel.yaraify.ruleCount=0, externalIntel.circl.hit=false, and externalIntel.malwareBazaar.hit=false provide no external corroboration.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The single sandbox gave an overall clean label
- The only observed contacted host had no cached malicious or suspicious reputation
- No dropped child was confirmed malicious
- CIRCL, MalwareBazaar, and YARAify returned no hits
- 39/75 antivirus detections
- Ten tier-1 engines flagged the file
- Multiple engines identify Java dropper or downloader behavior
- T1055 process-injection mapping
- T1543.002 service-persistence mapping
- T1562.001 defense-impairment mapping
Do not run this JAR; quarantine or delete it and keep endpoint protection enabled. If it was executed, isolate the affected device and perform a full scan plus persistence and process review.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete39 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Complete1 contacted host was cross-checked.
YARA
Complete1 signature or behavior rule matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 15MITRE ATT&CK techniques
- 10spawned processes
- 1network contacts
- 10filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Created or modified a system service, which can keep code running.
High concern: Attempted to impair or bypass security controls.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Transferred a file over the network; malware can use this to fetch additional payloads.
Moderate concern: Checks which security software you have installed.
Note: Collects details about your system.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How downloaders work
This file is a delivery vehicle. On its own it can look small and harmless, but its job is to quietly pull down and install the REAL payload — often a stealer, ransomware, or bot — from a server the attacker controls.
Bottom line:Because the dangerous part arrives later, early scans can look cleaner than the threat really is.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
KryptonPlus-leomannen112.jar
a7b387ec3a931640264d516f9a2901b6de2ab329b4059a87c0e4831a6bc59ffe
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
2616
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2616
04Isolated runtime analysis - Written fileObserved
3903daac9bc4a3b7.timestamp
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
assets.msn.com
Contact observed during runtime.
06Isolated runtime analysis
6 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- assets.msn.com
- C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2616
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
- C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
- C:\Users\user\AppData\Local\Temp\hsperfdata_user
- C:\Users\user\AppData\Local\Temp\hsperfdata_user\6592
- /tmp/hsperfdata_root/3589
Files this sample writes at runtime
This file drops 5 children at runtime. None are currently flagged malicious in our cache.
- 2668607e82a27f509647…eed0cdNever scannednever seen before
- 96e8f9e3e9db22bacd54…c507a2Never scannednever seen before
- 3073cfa6ce1abd0e21dc…974a63Never scannednever seen before
- 3f8096f14540c8e18e4e…ad10b8Never scannednever seen before
- d87c5f3cdfb5b7c0510e…1ade9eNever scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 1rule hit recorded
- 39 / 75engines flagged
- 1sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
39 of 75 antivirus engines flagged the file, including Alibaba and alibabacloud.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has been submitted 1 time from 1 source.
ProvenanceDerivedSourceSaved report factsObserved at - 04
Scanned file: KryptonPlus-leomannen112.jar — a7b387ec3a931640264d516f9a2901b6de2ab329b4059a87c0e4831a6bc59ffe
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: 2616 — C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\2616
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: 3903daac9bc4a3b7.timestamp — C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: assets.msn.com — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: downloader
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
39 of 75 engines flagged this file
View all 75 engine results
PE structure
Not applicablePE structure analysis applies to Windows executable formats, not this file type.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- KryptonPlus-leomannen112.jar
- Format
- JAR
- Code signing
- Not applicable to this file type
- Size
- 5.0 MB
- Last analyzed
- Sep 30, 2026, 2:28 PM UTC
a7b387ec3a931640264d516f9a2901b6de2ab329b4059a87c0e4831a6bc59ffeSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't open or run this Java file. Delete this Java file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already opened or ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Get a fresh copy from the publisher's official site and verify its exact hash when possible.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is KryptonPlus-leomannen112.jar a virus?
What is KryptonPlus-leomannen112.jar?
How many antivirus engines detected KryptonPlus-leomannen112.jar?
What should I do if I already opened or ran KryptonPlus-leomannen112.jar?
How do I remove KryptonPlus-leomannen112.jar?
What kind of malware is KryptonPlus-leomannen112.jar?
What is the SHA-256 hash of KryptonPlus-leomannen112.jar?
How up to date is this analysis of KryptonPlus-leomannen112.jar?
Community
Member reviews and reports for this exact file hash.