Hostile ^92% Download

mod-injected.jar

Steals Minecraft credentials, executes code

Minecraft token access alongside redirected child launchPrefire packed runtime Minecraft stealer

SHA-256e4deb6dd6a9aac86361c0008cff81e92c6e03cf1d2b1b8989f5441cb243ee80f

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(McGa)O₆(CaEuAlAs₃ErI)H₆(Cm₅Db₅F₃Os₂Po₅Ti)Md₂(Pa)

Evidence

Java bytecode ProcessBuilder constructor qo_erao_oi.class · 0x0–0x260

⋯9 more rows
0x9034070009010007456e636f64657201004......Encoder..
0xa0216a6176612f6c616e672f50726f6365!java/lang/Proce
0xb073734275696c64657224526564697265ssBuilder$Redire
0xc0637407000c0100186a6176612f6c616ect......java/lan
0xd0672f50726f636573734275696c646572g/ProcessBuilder
0xe007000e01000852656469726563740100......Redirect..
0xf0256a6176612f6c616e672f696e766f6b%java/lang/invok
⋯3 more rows
0x130686f6448616e646c6573070013010006hodHandles......
0x1404c6f6f6b75700100063c696e69743e01Lookup...<init>.
0x15000032829560c001600170a0004001801..()V...........
0x16000106c6c6b7661546b72696854786667..llkvaTkrihTxfg
0x17077690100174c636f6d2f676974687562wi...Lcom/github
⋯15 more rows

Java bytecode ProcessBuilder start qo_erao_oi.class · 0x315–0x3e5

⋯3 more rows
0x3453b29560c001600320a00210033010005;)V....2..!.3...
0x35573746172740c003500170a0021003605start..5....!.6.
0x365a3667bba11669b130500000000607f1c.f{..f.......`..
0x375a0050000000000000023050000000046.........#.....F
⋯7 more rows

JVM Base64 encodeToString call qo_erao_oi.class · 0xc19–0xdb9

⋯7 more rows
0xc89295b420c00ee00ef0a004900f001000e)[B.......I.....
0xc99656e636f6465546f537472696e670100encodeToString..
0xca916285b42294c6a6176612f6c616e672f.([B)Ljava/lang/
0xcb9537472696e673b0c00f200f30a000800String;.........
0xcc9f401002d0be6baa3ee8f94e9bc88ea8d...-............
⋯15 more rows

Java ProcessBuilder merges standard error qo_erao_oi.class · 0x1670–0x1770

⋯3 more rows
0x16a064546f0c017501640a000d017601000edTo..u.d....v...
0x16b072656469726563744f75747075740c01redirectOutput..
0x16c07801680a000f01790100137265646972x.h....y...redir
0x16d06563744572726f7253747265616d0100ectErrorStream..
0x16e01d285a294c6a6176612f6c616e672f50.(Z)Ljava/lang/P
0x16f0726f636573734275696c6465723b0c01rocessBuilder;..
0x17007b017c0a000f017d0100096469726563{.|....}...direc
⋯7 more rows

JVM iterates ZIP archive entries Amjwl.class · 0x3069–0x32a9

⋯3 more rows
0x30993b29560c002e02560a0250025701000c;)V....V..P.W...
0x30a96765744e657874456e74727901001a28getNextEntry...(
0x30b9294c6a6176612f7574696c2f7a69702f)Ljava/util/zip/
0x30c95a6970456e7472793b0c0259025a0a02ZipEntry;..Y.Z..
0x30d950025b0100166a6176612f7574696c2fP.[...java/util/
⋯7 more rows
0x3159612f696f2f42756666657265644f7574a/io/BufferedOut
0x316970757453747265616d0702690100186aputStream..i...j
0x31796176612f696f2f46696c654f75747075ava/io/FileOutpu
0x31897453747265616d07026b010006746f46tStream..k...toF
0x3199696c6501001028294c6a6176612f696file...()Ljava/io
⋯4 more rows
0x31e97453747265616d3b4929560c002e0274tStream;I)V....t
0x31f90a026a0275010004726561640c027702..j.u...read..w.
0x3209290a0250027801000577726974650100)..P.x...write..
0x321907285b42494929560c027a027b0a026a.([BII)V..z.{..j
0x3229027c010005636c6f73650c027e002f0a.|...close..~./.
0x3239026a027f01000d616464537570707265.j.....addSuppre
⋯7 more rows

Showing the top 5 files — 3 more files (70 regions) not shown.

No evidence locations were recorded for this file. Raw result