Hostile ^92% Download

GlazedAddon.jar

Steals Minecraft credentials, executes code

Minecraft token access alongside redirected child launchPrefire packed runtime Minecraft stealer

SHA-2561c81684f2e9338e419bae32abd15ace7951c355c431187f3aba8019280993d39

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(McGa)O₆(CaEuAlAs₃ErI)H₆(Cm₅Db₅F₃Os₂Po₅Ti)Md₂(Pa)

Evidence

Java bytecode ProcessBuilder constructor poVtl.class · 0x0–0x260

⋯8 more rows
0x802f7574696c2f42617365363407000901/util/Base64....
0x900007456e636f6465720100216a617661..Encoder..!java
0xa02f6c616e672f50726f63657373427569/lang/ProcessBui
0xb06c64657224526564697265637407000clder$Redirect...
0xc00100186a6176612f6c616e672f50726f...java/lang/Pro
0xd0636573734275696c64657207000e0100cessBuilder.....
0xe00852656469726563740100256a617661.Redirect..%java
0xf02f6c616e672f696e766f6b652f4d6574/lang/invoke/Met
⋯3 more rows
0x1306e646c65730700130100064c6f6f6b75ndles......Looku
0x140700100063c696e69743e010003282956p...<init>...()V
0x1500c001600170a00040018010003515177.............QQw
0x1600100124c636f6d2f6769746875622f70...Lcom/github/p
0x1706f56746c3b01000c6f6e496e69746961oVtl;...onInitia
⋯15 more rows

Java bytecode ProcessBuilder start poVtl.class · 0x310–0x3e0

⋯3 more rows
0x3403b29560c001600350a00240036010005;)V....5..$.6...
0x35073746172740c003800170a0024003901start..8....$.9.
0x360000672656676616c010011757969716c..refval...uyiql
0x37063745175786862754c66426a01002628ctQuxhbuLfBj..&(
⋯7 more rows

JVM Base64 encodeToString call poVtl.class · 0xc05–0xda5

⋯7 more rows
0xc75295b420c00eb00ec0a004d00ed01000e)[B.......M.....
0xc85656e636f6465546f537472696e670100encodeToString..
0xc9516285b42294c6a6176612f6c616e672f.([B)Ljava/lang/
0xca5537472696e673b0c00ef00f00a000800String;.........
0xcb5f101002a0ae0a4b5e19daeeeb6aee59c...*............
⋯15 more rows

Java ProcessBuilder merges standard error poVtl.class · 0x166a–0x176a

⋯3 more rows
0x169a64546f0c017201610a000d017301000edTo..r.a....s...
0x16aa72656469726563744f75747075740c01redirectOutput..
0x16ba7501650a000f01760100137265646972u.e....v...redir
0x16ca6563744572726f7253747265616d0100ectErrorStream..
0x16da1d285a294c6a6176612f6c616e672f50.(Z)Ljava/lang/P
0x16ea726f636573734275696c6465723b0c01rocessBuilder;..
0x16fa7801790a000f017a0100096469726563x.y....z...direc
⋯7 more rows

JVM iterates ZIP archive entries newRzfuw.class · 0x2fee–0x322e

⋯3 more rows
0x301e3b29560c002e024c0a0246024d01000c;)V....L..F.M...
0x302e6765744e657874456e74727901001a28getNextEntry...(
0x303e294c6a6176612f7574696c2f7a69702f)Ljava/util/zip/
0x304e5a6970456e7472793b0c024f02500a02ZipEntry;..O.P..
0x305e4602510100166a6176612f7574696c2fF.Q...java/util/
⋯7 more rows
0x30de612f696f2f42756666657265644f7574a/io/BufferedOut
0x30ee70757453747265616d07025f0100186aputStream.._...j
0x30fe6176612f696f2f46696c654f75747075ava/io/FileOutpu
0x310e7453747265616d070261010006746f46tStream..a...toF
0x311e696c6501001028294c6a6176612f696file...()Ljava/io
⋯4 more rows
0x316e7453747265616d3b4929560c002e026atStream;I)V....j
0x317e0a0260026b010004726561640c026d02..`.k...read..m.
0x318e1a0a0246026e01000577726974650100...F.n...write..
0x319e07285b42494929560c027002710a0260.([BII)V..p.q..`
0x31ae0272010005636c6f73650c0274002f0a.r...close..t./.
0x31be0260027501000d616464537570707265.`.u...addSuppre
⋯7 more rows

No evidence locations were recorded for this file. Raw result