🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://OSBOT.net/OSBot.jar.

Database Entry


IOC ID:1958961
IOC: https://OSBOT.net/OSBot.jar
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS31400 ACCELERATED-IT
Country:- DE
First seen:2026-10-09 19:32:48 UTC
Last seen:2026-10-09 21:09:23 UTC
UUID:89078a21-c416-11f1-bd13-42010aa4000a
Reporter ratcatchers
Reward 5 credits from ThreatFox

Avatar
ratcatchers
Multi-stage campaign targeting Old School RuneScape players. Steals Discord tokens, screenshots and .txt files from Desktop/Downloads, runs a crypto clipboard clipper, persists via Startup folder (Spoon2.jar/Spoon2.bat), drops https://ikovrsps.com/Mina.jar (XMRig Monero miner, adds Defender exclusion, renames to update1.exe) and replaces RuneLite.exe with a trojanized Launch4j RuneLite launcher. That launcher pulls a modified RuneLite client.jar with hidden plugins that steal login passwords (keylogger), Jagex Launcher session tokens (JX_ACCESS_TOKEN/JX_REFRESH_TOKEN), bank PINs, bank value and location, plus remote logout via chat trigger "hehelolxd". Clipper wallets: ETH 0x24f986fb40B95125f67527B4a1D7f1b1EacEa05c, BTC bc1qpuyk33zygw35jsy75gdvxamq87cazxc4dy2f6h, SOL E9wTYd7cUid8GbQeNQu14JLeZzf5qnfgYKqKNy7P1pZK, LTC ltc1qfvgkf4tuy4e0xgmc0tjj5t4mvux3khkw9vslxf, TRX TCCt6zYzrYnbbB4cypEPDf7KF1fdyYDCNW, XRP r92C9W3Z9z1kcuh91DCabRkP2QTCycogRo, DOGE DJbAHA82xeg969HopSoXJ8shzasNKCDsa4.