s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-0e54456701cb53a73c4330dbe4c749afa6a7f61406e6ed3df368329852737757 high

📛 Threat Title

Unknown: Thorium.jar.github-Course23sz

Category: Unknown Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: zip. Size: 614101 bytes. Reporter: GhostTypes. First seen: 2026-09-25 12:07:39.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 0e54456701cb53a73c4330dbe4c749afa6a7f61406e6ed3df368329852737757 VT 5 / 75

IOC database

Type
hash_sha256
Value
0e54456701cb53a73c4330dbe4c749afa6a7f61406e6ed3df368329852737757
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Unknown

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 5 of 75 VirusTotal vendors

VendorVerdictDetection
Alibaba malicious Trojan:JAVA/Generic.8c75fbd5
ESET-NOD32 malicious Java/Agent.ADG trojan
Fortinet malicious Java/Agent.ADG!tr
Ikarus malicious Win32.Outbreak
Kaspersky malicious HEUR:Trojan.Java.Generic

Details From VirusTotal

Basic Properties
MD5e295e74fd25a81ccc904808a0500df9a
SHA-1340eafd6e02716e7e235ce060117c9a69adcd49c
SHA-2560e54456701cb53a73c4330dbe4c749afa6a7f61406e6ed3df368329852737757
VHash8c2d1ce2d4c15d473149357c36f30613
SSDEEP12288:/KXo2vP3gI4lI24i9IlUYf0wbxg0umQj/urSitHc36:yfPXHgSlUYf0EtFuwVVc36
TLSHT1DED4125ED68510B1E12F527846141E62B81C9EC8FF06B0339EF25B5B48939DBDB036EE
File typeJAR
File type tagjar
File extensionjar
MagicZip archive data, at least v2.0 to extract, compression method=deflate
File size599.7 KB
History
First seen on VirusTotal2026-08-30 17:49 UTC
Last submission2026-09-25 13:16 UTC
Last analysis2026-09-25 13:16 UTC
Last modified on VirusTotal2026-09-25 15:18 UTC
Known Names
  • 46jxm2nj.exe
  • 0e54456701cb53a73c4330dbe4c749afa6a7f61406e6ed3df368329852737757.zip
  • 2a691b81-9c56-4d47-8400-8be96a224fcb
  • Thorium.jar
  • Thorium (1).jar
  • Nicht bestätigt 170196.crdownload
hash_sha1 340eafd6e02716e7e235ce060117c9a69adcd49c VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/340eafd6e02716e7e235ce060117c9a69adcd49c

IOC database

Type
hash_sha1
Value
340eafd6e02716e7e235ce060117c9a69adcd49c
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/340eafd6e02716e7e235ce060117c9a69adcd49c

hash_md5 e295e74fd25a81ccc904808a0500df9a VT 5 / 75

IOC database

Type
hash_md5
Value
e295e74fd25a81ccc904808a0500df9a
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 5 of 75 VirusTotal vendors

VendorVerdictDetection
Alibaba malicious Trojan:JAVA/Generic.8c75fbd5
ESET-NOD32 malicious Java/Agent.ADG trojan
Fortinet malicious Java/Agent.ADG!tr
Ikarus malicious Win32.Outbreak
Kaspersky malicious HEUR:Trojan.Java.Generic

Details From VirusTotal

Basic Properties
MD5e295e74fd25a81ccc904808a0500df9a
SHA-1340eafd6e02716e7e235ce060117c9a69adcd49c
SHA-2560e54456701cb53a73c4330dbe4c749afa6a7f61406e6ed3df368329852737757
VHash8c2d1ce2d4c15d473149357c36f30613
SSDEEP12288:/KXo2vP3gI4lI24i9IlUYf0wbxg0umQj/urSitHc36:yfPXHgSlUYf0EtFuwVVc36
TLSHT1DED4125ED68510B1E12F527846141E62B81C9EC8FF06B0339EF25B5B48939DBDB036EE
File typeJAR
File type tagjar
File extensionjar
MagicZip archive data, at least v2.0 to extract, compression method=deflate
File size599.7 KB
History
First seen on VirusTotal2026-08-30 17:49 UTC
Last submission2026-09-25 13:16 UTC
Last analysis2026-09-25 13:16 UTC
Last modified on VirusTotal2026-09-25 15:18 UTC
Known Names
  • 46jxm2nj.exe
  • 0e54456701cb53a73c4330dbe4c749afa6a7f61406e6ed3df368329852737757.zip
  • 2a691b81-9c56-4d47-8400-8be96a224fcb
  • Thorium.jar
  • Thorium (1).jar
  • Nicht bestätigt 170196.crdownload

References (1)

Remediations (10)

  • Malware analysis Thorium-1.21.1.jar Malicious activity - any.run
    web:any.run

    Online sandbox report for Thorium-1.21.1.jar, tagged as etherhiding, stealer, weedhack, verdict: Malicious activity

  • Attackers keep using GitHub to distribute malware - Cybernews
    web:cybernews.com

    The Windows malware can steal browser passwords, cryptocurrency wallet data, and other sensitive information from developers. GitHub removed many flagged repositories, but researchers expect attackers to keep creating new fake accounts automatically.

  • Hackers Compromised 10,000+ GitHub Repositories to Inject Malicious ...
    web:cybersecuritynews.com

    GitHub malware campaign infects 10,000+ repositories with Trojanized files, exposing gaps in automated detection.

  • Remediating a leaked secret in your repository - GitHub Docs
    web:docs.github.com

    This will help you assess the risk and determine the best course of action for remediation . Determine the secret type and its provider. For example, is the secret a GitHub personal access token (PAT), an OpenAI API key, an SSH private key? Locate the repository, file and line that contains the leaked secret. Identify the secret owner.

  • Massive GitHub Attack Injects Malware into 10,000 Compromised ...
    web:gbhackers.com

    A large-scale malware distribution campaign utilizing GitHub repositories has been uncovered, weaponized over 10,000 repositories.

  • Releases · Alex313031/thorium - GitHub
    web:github.com

    Chromium fork named after radioactive element No. 90. Source code and Linux releases. Windows/MacOS/ARM builds served in different repos, links are towards the top of the README.md. - Alex313031/th...

  • thorium · GitHub Topics · GitHub
    web:github.com

    GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

  • RatOrNot — Free Minecraft JAR Malware & RAT Scanner
    web:ratornot.com

    Free online Minecraft JAR scanner. Check mods from CurseForge or Modrinth for RATs, token stealers, and infostealers. AI-powered verdict, no account needed.

  • Massive GitHub malware operation spreads BoryptGrab stealer
    web:securityaffairs.com

    It uses techniques from public GitHub tools designed to bypass Chrome's App-Bound Encryption and decrypt stored browser credentials. The malware loads an encrypted internal payload that extracts saved passwords and records installed applications. BoryptGrab also downloads a helper tool to assist with Chromium-based browser extraction.

  • GitHub Malware Explained: Risks, Attacks & How to Stay Safe 2026
    web:software.viginet.net

    Learn how GitHub malware spreads through fake repositories, malicious code, and infected downloads. Discover warning signs and practical tips to protect your PC in 2026.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.