He Sent Me Minecraft Malware (Java Deobfuscation)
Source: YouTube · John Hammond · published Jul 16, 2024 · 28:42
This video demonstrates the analysis of a malicious Minecraft mod containing info-stealing malware 0:00. The video author decompiles the Java code to reveal how the malware steals user data.
Key Takeaways:
• The malware uses multiple encryption methods (DES, Blowfish, XOR) to obfuscate its functionality 5:46-8:07
• The creator builds a custom decryptor to unveil the encrypted strings and understand what data is being stolen 9:00-25:03
• The malicious mod steals Discord tokens, Microsoft accounts, user information, and other sensitive data 25:03-25:48
• All stolen information is sent to a command and control server via HTTP POST requests 25:48-26:19
This analysis highlights the importance of verifying the safety of game mods before installation.
Sources:
- 0:00 Introduction to the malicious Minecraft mod
- 5:46-8:07 Analysis of encryption methods in the malware
- 9:00-25:03 Creating and running the custom decryptor
- 25:03-25:48 Revealing what information the malware steals
- 25:48-26:19 How stolen data is transmitted to the attacker
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
so I received this email and it says hey John I came across a token or session stealer posing as a repository that I help contribute to I had some fun decompiling and deop skating the file and I figured you might as well they include the links to the actual project and the infected project and he includes the whole infected jar file it is Java a Java archive from the releases of the infected repository as a zip file as well as the main stealer itself as a separate zip file as it's located confusingly deep within the Java structure itself the file is a mod for Minecraft which in itself has obfuscated game code so there'll be some things symbols called like fieldcore 71412 D or whatever and they'll appear in the decompiled Java file however the mappings for that version of Minecraft I assume…