- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
3949e20ad36eff836803dc536340c2fc7df232ecf21216379e92cbdfe75cfdf6- SHA1
c75995ff7cf93a8693f0b43ed5c9427a8bdbf9da- MD5
74b244b4f4b5bcf9deebb2181bf29dd7- Filename
- 1trouser-streak-1.4.5-1.21.4-.jar
- File type
- jar
- MIME
- application/java-archive
- File size
- 3503332
- Filename variants
- 2 reported
- TLSH
T1D4F533566963098ECA746634BC63C8C19CFE94DC948DB11902F4E641E843EFF1BA267F- SSDEEP
98304:CrL4KIKiT6KXXRWvvpvso4+NyQAFxOWM2fIvj:AL4iiT6kWpEoRyQMdzAvj
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (9%).
Confidence signal
VirusSign confidence is elevated at 68%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections9%
VirusSign confidence68%
Relationship context3 visible
Threat classificationjava
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
3shown
0%
json
3608 bytes
contains
Filename
1trouser-streak-refmap.json
File type
json
MIME
application/json
Size
3608
SHA1
e9bd3ebfc3bb58f64b07acaddb78428e44402881
0%
java-bytecode
633 bytes
contains
Filename
OffGroundSpeedEvent.class
File type
java-bytecode
MIME
application/java-vm
Size
633
SHA1
f067078d3cf2ef5ac69bc60ba3b74753602b7bc0
0%
png
2877 bytes
contains
Filename
icon.png
File type
png
MIME
application/octet-stream
Size
2877
SHA1
aa6c4dc9d8e393385e2ff845e537304cdfa778ff
Analysis details
Severity: criticaltrojanenv-checkprocess-renamejardebug-checkstealer
Freshness: Fresh · Last seen 5 days ago.
- Detection rate
- 9%
- Threat type
- trojan
- Family
- java
- Confidence
- 68%
- detection
- 9 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
3949e20ad36eff836803dc536340c2fc7df232ecf21216379e92cbdfe75cfdf6- SHA1
c75995ff7cf93a8693f0b43ed5c9427a8bdbf9da- MD5
74b244b4f4b5bcf9deebb2181bf29dd7- Filename
- 1trouser-streak-1.4.5-1.21.4-.jar
- File type
- jar
- MIME
- application/java-archive
- File size
- 3503332
- TLSH
T1D4F533566963098ECA746634BC63C8C19CFE94DC948DB11902F4E641E843EFF1BA267F- SSDEEP
98304:CrL4KIKiT6KXXRWvvpvso4+NyQAFxOWM2fIvj:AL4iiT6kWpEoRyQMdzAvj- First seen
- 2026-11-05T08:31:05Z
- Last seen
- 2026-11-05T09:04:59Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (9%).
Confidence signal
VirusSign confidence is elevated at 68%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type trojan and family java.
Relationship context
3 related indicators are shown across 1 relationship group(s).
Observation timeline
4 timestamped observations are arranged from 2025-02-13 to 2026-11-05. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
1 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family java.
Last seen 5 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 1trouser-streak-1.4.5-1.21.4-.jar
- File type
- jar
- MIME
- application/java-archive
- Size
- 3503332
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Classification label
- Creates hidden files and/or directories
- Executes commands using a shell command-line interpreter
- Executes the "systemctl" command used for controlling the systemd system and service manager
- Non-zero exit code suggests an error during the execution. Lookup the error code for hints.
5 shown
View MITRE ATT&CK details · 5 shown
- T1564.001 — Creates hidden files, links and/or directoriesTactics: TA0005
- T1064 — Executes commands using a shell command-line interpreterTactics: TA0002 · TA0005
- T1543.002 — Executes the "systemctl" command used for controlling the systemd system and service managerTactics: TA0003 · TA0004
- T1082 — Reads CPU information from /proc indicative of miner or evasive malwareTactics: TA0007
- T1518.001 — Uses the "uname" system call to query kernel version information (possible evasion)Tactics: TA0007