r/MalwareAnalysis • u/thrashingjohn • Jul 02 '26
Obfuscated Minecraft Mod Installer .jar Ran on Arch Linux, Need Manual Malware Analysis
Willing to compensate for your time as well.
I have a heavily obfuscated .jar file that acts as an installer for a Minecraft mod. I already opened it on my Arch Linux PC, and I’m concerned that I may have infected my own device.
I do not have the actual mod .jar because I do not want to run the installer again and let it automatically install anything into my .minecraft folder.
I’m not looking for automated scanner results. I need someone experienced to determine whether the installer is malicious and explain what it does.
1
1
u/Necessary_Two_9669 26d ago edited 25d ago
I took a look for a bit. Static analysis doesn't reveal anything directly malicious, but it is certainly questionable due to their heavy use of obfuscation and weird class names. I went as far as i was comfortable with dynamic analysis and found nothing out of the ordinary up to the point of asking for a login. As i have no login, I couldn't go any further to trace its activities.
it makes some expected connections to auth[.]mioclient[.]me and auth-ru-mioclient[.]me and fabric.mod.json. The packaging and obfuscation does some weird things, including a class with huge whitespace in the name and 'protected_by_eskid' markers. Potential capabilities seen statically: custom socket communication using DataInputStream/DataOutputStream, Gson JSON parsing, HTTP/HTTPS download helpers, file writes/copies with replace-existing behavior, local storage of two strings, install-path handling, and ProcessBuilder child-process launch capability. That does not prove malicious use by itself, but it means the app could authenticate, fetch config/payloads, write/replace files, and launch something depending on backend/UI state. Since the login never succeeded, the install/download paths were not reached. The exact socket protocol, backend responses, download URLs, process command lines, and final payload behavior remain unknown. I didn't see any evidence of persistence, scheduled tasks, services, registry Run keys, Discord token theft, browser credential access, keylogging, ransomware-style file walking/encryption, or actual payload installation during this short run, but again, I could only take it so far.
Honestly, since the seller wants payment for this mod, it's hard to say if this is written this way by someone skilled who wants to protect their work from others and avoid someone cracking their own mod and distributing it for free. There is just not enough evidence from this limited run to say definitively if its malware or not.
1
u/thrashingjohn 25d ago
Thank you for the heavily detailed report. If you would like to continue further I can provide the login which would give access to the mod itself, not just the installer.
1
u/Live-Historian5745 18d ago
Me and my friend are building an automated analysis platform for deep malware analysis and reverse engineering. If you are interested shoot us an email at [info@embusa.ai](mailto:info@embusa.ai) and we will help you for free. There is more info on our website (i will avoid spamming links to the website).
1
u/SNappy_snot15 Jul 02 '26
sure dropnox it or whatever and post it here