i need your help.

0:00I need your help because I don't know a

0:01whole lot about this Minecraft hacks or

0:04Minecraft modding community. And people

0:06keep saying words like fabric, hypixel,

0:08chat triggers, and I got to be honest, I

0:11don't know what any of that stuff means.

0:12So, please, I need your help. Help me

0:14learn, school me, educate me. Let me

0:17know in the comments what this whole

0:18wild world is. I did find

0:21chattriggers.com

0:22that explains everything is in

0:24JavaScript. You can get started with

0:26Slate and here's some documentation, but

0:29I don't know a whole lot more other than

0:31this thing exists. Presumably, you can

0:33look for different modules with this

0:35link here and that will help you get

0:38different things. But these are mods,

0:41right? These are modifications to

0:43Minecraft in the game. Oh, this is a RZ

0:45notifier. It notifies you when RZ

0:47appears anywhere in chat. Drop RZ in the

0:50comments. Anyway, someone sent me this

0:52email. It says Minecraft chat triggers

0:55module malware. Hello. Recently, I came

0:57across this file. It's a chat triggers

0:59module which seems innocent, but after

1:01checking the files, I found two links to

1:03malicious code. Note, there could be

1:05more that I haven't found. The first one

1:06is at this file and line number. The

1:08other one is just beneath it. And they

1:10give a link. It seems to read code from

1:13hst.sh.

1:15I don't really understand JavaScript

1:16code, but from what I could find, it's

1:17definitely malicious according to this

1:20individual. Thanks so much for sending

1:21me malware. Looks like they provided

1:23sample.zip. And let's go ahead and

1:25download that. Now, I'm going to be

1:26working inside of my Windows 11 virtual

1:29machine, and I really recommend you do

1:30the same. Operate inside of a virtual

1:32machine if you're working with malware

1:34or just strange, sketchy, suspicious

1:37files and software. So, inside of the

1:39zip archive, we have a folder called

1:41Bye-Bye Golder. We can go ahead and

1:43extract this. I actually want to use

1:44sevenzip. So, I'm going to shift

1:46rightclick and then extract to that

1:48sample. Now, inside of that directory,

1:50we have that by Golder folder. And let's

1:53see what's in there. In all reality,

1:55since there are a lot of files here, it

1:56might just be better for us to open up

1:58that entire directory inside of a text

2:00editor. I like to use Sublime Text. So,

2:02let me make this full screen and open up

2:04this folder for us. Now, I'm going to be

2:06honest with you. I did get a chance to

2:08take a peek at this stuff before I

2:10started recording. And I really wanted

2:11to show you this one because it's kind

2:14of hysterical. Let me turn word rap on

2:16so you can see. But honestly, you know,

2:17I like, oh, when things are obfuscated,

2:20when things try to hide or mask their

2:22operations, so it's some code puzzle

2:24piece that you just get to unravel. But

2:26in this case, there's really not a whole

2:27lot to have to rip apart or deobuscate.

2:31It's kind of all in the clear.

2:32Apparently, this mod chat trigger

2:34module, I'm assuming, I hope, let me

2:36know in the comments, is named by

2:39Goldor. And if we try to go look for

2:41that, search for it or find it on the

2:43chat triggers module page. I haven't

2:45found it. Not going to lie, I don't

2:47think it's here. Maybe it was served at

2:49one point but is no longer. Maybe it was

2:51taken down because it was determined to

2:52be malicious, but no modules found. I

2:55don't know how this individual got this

2:56file. That's fine. To be honest, I'm

2:58more interested in showing you the code.

3:01So, let's look at the entry point

3:03index.js, JS, which obviously is all of

3:06the stuff that's usual for boilerplate

3:09setup, importing libraries, modules, and

3:11doing some of this stuff here. Some of

3:14the lines, note messages. Oh, you're put

3:15in the sky block lobby. Uh, and there's

3:18not a whole lot else to this file. Only

3:2162 lines, mostly imports, but we'll find

3:25where is the malicious component?

3:27Imports config, of course. Not a whole

3:29lot more here. Thankfully, our friend in

3:32the email gave us a clue as to what file

3:34we might look at because obviously there

3:37is a lot in this zip archive for us to

3:40try to look through. So, let's speedun

3:42just a little bit. They mentioned the

3:44utils directory has one file called

3:46utils.js that has a malicious line. Now,

3:51you might remember the line number, but

3:53looking at this file, can you find it?

3:55Can you see it? Can you already see the

3:58sketchy stuff? It may or may not stick

4:00out like a sore thumb because amongst

4:02all of these export constant lines at

4:04the very top here, you see lines 33 and

4:0834 that declare a function based off the

4:11file lib module object something using a

4:16method or function called get URL

4:18content passing in a URL https and

4:21hst.sh

4:23just as they mentioned. They reach out

4:25to one endpoint on that site with the

4:28raw prefix presumably to get the full

4:31raw bytes and contents. And then after

4:33that's defined as a function, they call

4:36it with the two opening and closing

4:38parenthesis. Now, let me ask you, have

4:40you heard of hst.sh

4:43before as a website? Let's go take a

4:45look at it. Back in our browser, let's

4:48open up another tab. Let's go to hst.sh.

4:52Ah, presumably haste bin. You might be

4:54able to see down in the bottom left the

4:56about page here. It is basically paste

4:59bin, right? You get to choose any

5:02content, any data, any text, any info,

5:04and just slap it out onto the internet

5:06with a hosting provider like this. Not

5:08to say a hosting provider in its

5:10formality. It goes without saying, a lot

5:12of malware payloads could just as easily

5:14be hosted or served by PayPin. And if

5:16this is an equivalent, okay, it's just

5:18being used and abused, leveraged to put

5:21content out on the internet. So anyone

5:23else or any victim could have it be

5:25pulled down and executed. So let's grab

5:27the URL that they are referencing here

5:29and let's go see what the actual code

5:32that detonates is. Back in the URL bar,

5:35let's go ahead and get to that location.

5:38And we start with that good old Discord

5:43API key and canary it looks like. So

5:46this is what we have to dig into. And

5:48I'm telling you, there are no secrets

5:49here. It's not obuscated. We're going to

5:51have a lot of fun looking through this

5:52code and seeing how it all works. So you

5:54get an understanding of what does

5:56malware in Minecraft malware mods being

6:00used and abused for payloads like this.

6:02What does it do and what does it look

6:03like? But before we do all that, please

6:05let me tell you about the sponsor of

6:06today's video, Cape. It's one thing when

6:09your cell phone gets hacked. It's a

6:11whole another thing when your cell phone

6:12provider gets hacked. Mobile carriers

6:15are in the headlines all too often for

6:17data breaches and surveillance scandals

6:19or even just selling your info. Cape is

6:21a modern mobile carrier that does things

6:24differently. They're privacy first and

6:26privacy focused through and through.

6:28It's an expert-led team with roots in

6:31telecom and security. They don't ask for

6:34your name or your address or social

6:36security number and they don't collect

6:38any data they don't have to. the data

6:40they do have to collect like call

6:42metadata or anything necessary, they

6:44delete it and they'll never sell your

6:46data. They can't. They don't have it in

6:48the first place. Cape has all these

6:50awesome security features. SIM swap

6:53protection, encrypted voicemail, even a

6:55recovery phrase to generate a

6:57cryptographic key pair for a public key

7:00and private key. That cryptographic

7:02approach was actually based on input

7:04from Dan Guido, a friend of mine and a

7:06technical adviser at Cape. You might

7:08know the name from Trail of Bits. And

7:10Cape is vetted by even more of the most

7:13respected names in cyber security like

7:15Dimmitri Alparovich, one of the

7:17co-founders of Crowdstrike and Dne

7:19Stucky, OpenAI's Sizo. And if you love

7:22the security and privacy first carrier,

7:24you can use my code Hammond 33 to get

7:2733% off your first 6 months with Cape.

7:30You can get started with Cape with my

7:32link below in the video description,

7:34jh.live/cape.

7:36Huge thanks to Cape for sponsoring this

7:38video. All right, now that we're back to

7:41it, we've got the first payload that was

7:43being served on haste bin, a paste bin

7:45equivalent. So, let's copy all this and

7:47get it into our text editor so that we

7:48can work with it. We can call this like

7:51payload one, I suppose. Trying to save

7:53that out in another location so we're

7:55not confused with the other files here.

7:57And while we're at it, let's go ahead

7:59and get the other HST.sh

8:03script back up in the URL. We have this.

8:05Let me save that as payload 2.js. Let's

8:08get into that in a moment. Let's get

8:10word rap back on. But obviously the very

8:12start is defining a variable for a web

8:14hook URL. Needless to say that is a

8:17Discord web hook. We could probably do

8:19some shenanigans with that whether we

8:21send it messages or delete the web hook.

8:23You could do you know whatever you want

8:25since that key is present there. And

8:26beneath that is a send function that

8:29uses this web hook URL too and simply

8:32sends data to that web hook. Nothing

8:34fancy there. Paste is another function

8:36that looks like a convenience just to be

8:38able to slap anything else onto Haste

8:41bin. You see that URL there? That all

8:43looks like regular boilerplate code, but

8:45when we get a little bit further down,

8:46we start to see more Minecraft specific

8:49things and much more malware specific

8:51functionality. One thing that I have

8:53been learning, again, please school me

8:55in the comments here, but there are

8:56these Minecraft functions that are

8:59defined or based off of I think whatever

9:01version that you're up against, whether

9:03it's Minecraft Forge or some of the

9:05toolkits and frameworks to be able to

9:06make mods similar to this. So

9:08funk_110432

9:11capital i148254_d

9:15are all specific to the game. But we can

9:17get different functions or different

9:19fields and go figure out what those

9:20actually mean because that is relatively

9:24obfuscated and that we can't tell what

9:25it does just based off that string of

9:27numbers. And again, please let me be

9:29fully upfront. I've got a lot to learn

9:31here. So genuinely, anything I'm really

9:32asking, I need your help. Let me know in

9:35the comments what all this is supposed

9:36to do. if this is right. Are there other

9:38resources? I apparently got to get smart

9:41on the Minecraft mod and Minecraft

9:44hacking community. But you can see in

9:46resources like this, some function names

9:48or other field names would refer to

9:50based off of the numeric key and letter

9:53that follows what actual function

9:56purpose or better read name should be.

10:00Like funk 700062B

10:03is set current item or armor. And this

10:05list goes on and on and on. Doing my

10:08homework a little bit more, I found

10:10another repository for Minecraft

10:12deobuscator 3000. Uh, looks like that

10:15had a little bit more or at least

10:16different variations of the version

10:18potential. Uh, or something that could

10:20better match our function names or

10:22numbers cuz I didn't find the ones that

10:24we were looking at in that previous

10:26list. I see another 1.7 that looks to

10:28have more fields, methods, and

10:30parameters again with the seven prefix.

10:33If I go back just a moment, the 1.12

10:37stable mappings seem to have what I was

10:39looking for. Methods here in this file,

10:41I see a couple of the funk

10:44prefix that we're probably up against.

10:46So, I could control F and look inside of

10:49this list. What is actually being called

10:52if we were to use funk_110432_I?

10:58Let me control F for that. Looks like it

11:00is get session H. Question is, can we

11:03get 148254?

11:05Control F for that one. Oh, get token.

11:08Okay, now that's called for something

11:11being set to an SSID, which seems more

11:14like a Wi-Fi for me. Like I think of oh,

11:16your broadcast Wi-Fi network name. Not

11:18positive. Maybe that tracks again.

11:20School me. Other objects, other types

11:22brought in environment variables that

11:24have their data retrieved like your app

11:26data or your local app data directory on

11:28your computer. Let's see what the M

11:30folder one is pulling with that function

11:32name or field. I'd presume that that is

11:36like your Minecraft folder. Let's

11:38control F for that. Oh, dang. I can't

11:40find that one. Okay, 71. So, again,

11:42let's hop back and use a different

11:44mapping. I'm sure one of these tools

11:46probably like does this all for you. I

11:48can't find that one. So, I'm trying to

11:50track this one down, but um is there a

11:54better resource for these things? Am I

11:56not doing this the right way, the smart

11:58way? Let me know. Googling around, it's

12:00funny to see some of the high pixel

12:01shenanigans of is is this a rat? Is this

12:03legitimate? Is this malware? Uh maybe

12:05there's another mapping here. Can I

12:07control F for that? Give me just that

12:09field name. Yeah, public final file.

12:12Okay, I don't want to fall down the

12:13rabbit hole too much. I'm assuming

12:15that's just your Minecraft folder, hence

12:17the client get Minecraft field file type

12:20get path. Others here though, looks like

12:22we're trying to retrieve the

12:24accounts.json.

12:25Potentially sensitive info there. Same

12:27thing with the Prism Launcher, Minecraft

12:30launcher profiles, Microsoft account,

12:32etc., etc., feather and then they check

12:36their IP address using check IP from

12:39Amazon AWS. If they find Prism, then

12:42they will retrieve out the accounts from

12:44there. And then they paste all of this,

12:47hence the paste function above that ends

12:50up creating a new paste bin entry.

12:53Remember this paste function just above?

12:55So obviously they're exfiltrating that

12:57data out as you are infected,

12:59compromised, and hit with malware like

13:01this. And because they're able to

13:02retrieve your name, the payload that

13:04they end up creating, they literally

13:06make a title, you got ratted with the

13:09URL for, I'm assuming, sky pixel

13:12something, uh, username or profile,

13:14right? Static color, an author that's

13:17hard-coded, SSID. Okay, that seems to be

13:19it, right? Username, UU ID, and IP

13:21address are all added. And then it puts

13:23in all the links for the haste bin

13:26entries that it has just made because

13:28remember that is returned from the paste

13:31function but then it sends it to discord

13:34with the send function above which is

13:37using that web hook. So stupid silly

13:40again not obuscated immediately obvious

13:42and egregious info stealer right now. I

13:45don't play Minecraft but I can only

13:47assume a lot of the things that are

13:49present in the accounts.json JSON files

13:52are probably sensitive. Now, let's look

13:54at payload 2. This is the blurb that was

13:57the second call to the haste bin paste

14:00bin site just following the original

14:02one. And that looks like it adds

14:05honestly persistence. Is that fair to

14:07say? Let me know. Again, please tell me

14:09here because they get the modules

14:11directory, then they use Bloom Core

14:14dungeons as a directory for that. They

14:16make those directories if they don't

14:17exist and they end up staging what would

14:19eventually become dungeon.js. They even

14:22create a flag file like a little

14:24placeholder or marker to say, "Hey, this

14:26host, this computer, this victim has

14:29already been compromised. The injection

14:31is done." And that's what they create as

14:32a file. current context means reading

14:35from that file and they inject another

14:39function style function parenthesis file

14:42lib get URL content of once again

14:45another HST or hast bin site heyload we

14:48could pull down. So let's copy that so

14:50we can take a look and while all of this

14:52is just defined created as variables

14:54here then they actually do it in the if

14:56statement to check if the flag file

14:58doesn't exist. So if this is a new

14:59victim and if it doesn't already include

15:02okay this prompt to pull down and

15:04execute a new payload write it put it

15:06there then it displays injection

15:08completed at that date and time.

15:11But now we have a third payload correct

15:14we have another HST or paste bin

15:17presented file and script that we can go

15:20take a look at. So let me go to that

15:23page see if it's still live and it looks

15:25like it is. Oh, it's so obvious. Okay,

15:30let me copy all this and get into our

15:32text editor. Payload 3.js.

15:36Okay. Um, obviously you can see some

15:40sketchy stuff from just these variable

15:42names, right? Couple utilities here. Oh,

15:44a little message printer, debug log, log

15:47error. But then they create a key that

15:50looks like B 64, but that's very likely

15:52if we were to decode it. And I say B 64

15:54encoding as another representation of

15:56data. Uh uh trailing equal sign helps

15:59give away the padding there and this the

16:01random uppercase and lowercase number

16:04smattering does clue us in. But that's

16:07probably just raw byes because they have

16:09an encrypt function here and a decrypt

16:11function that looks like it's doing some

16:13as crypto magic to be able to encrypt

16:16and decrypt data. But then they have a

16:20C2 present alive and well naked outright

16:24and dangling with the IP address and

16:27port number. Obviously a convenience

16:29function send to C2 where it takes in

16:32some data as an argument noting the

16:34endpoint that's provided and encrypts

16:37all that data. Okay, cool. Kind of smart

16:40even if all this you know payload code

16:42isn't obuscated or encrypted. The

16:44command execution though is just what

16:45you would expect. This is the real RAT

16:47or remote access Trojan remote access

16:49toolkit present here because it's using

16:52cmd.exe/

16:54C. So the command prompt and then an

16:56argument to run another command that

16:58follows to do whatever. Copy files,

17:01steal more files. Oh, execute programs,

17:04run more code. Even checks the operating

17:06system, which is kind of neat. I

17:07appreciate all the comments here that

17:08let us know of that. So if it's Windows,

17:11then they'll use that. Otherwise, maybe

17:13Linux, they'll use SH. And you see the

17:15usual Java syntax to be able to start a

17:18process, execute a command, and it's

17:20even got the capability to take

17:22screenshots or convenient operations to

17:25work with the file system, list

17:27directories, delete files, but the

17:30screen streaming is the creepy bit,

17:34right? You're owned. Say you had this

17:36mod. Say you installed this some way

17:38somehow. Uh, if it executed, if it ran,

17:41sure. Now it's got that silly stupid

17:43stalkerware stuff to take pictures of

17:46your screen. And then I'm assuming,

17:49yeah, forward that out, send it via the

17:52C2 with a screen stream endpoint based

17:56off the specific player, that victim,

17:58and anyone could watch you doing

18:01whatever you do on your computer or in

18:04the real world with the webcam capture.

18:06You can see all the syntax here. start

18:08webcam stream. Uh, again, this being

18:11sent to C2 based off of a player unique

18:14identifier. So, there's that. Now, we

18:17get to the info stealer component here.

18:18Even more, the account grabber. Again,

18:21we're seeing this uh just as we had

18:23previously. Multimc, lunar, feather,

18:26prism, etc. All these Minecraft things.

18:28Again, I'm not familiar with, so school

18:30me. Let me know in the comments, please.

18:31But here's the more traditional malware

18:34aspect where we're exfiltrating or

18:35extracting data out of your web

18:37browsers. That's info stealer stuff.

18:40Getting everything out of Firefox,

18:42Chrome, Edge, Opera, Brave, etc. And

18:45then ripping through what would be like

18:47SQL or structured query language,

18:49databases or other entries in there to

18:52get specific login, username and

18:54password, oh your cookies, the sessions

18:56that you already have authenticated to

18:58different websites. And they are not shy

19:01about this. Again, you see in all the

19:03actual content of this file of the

19:05script here, it's outright. It's not

19:07obuscated. They're not trying to hide

19:09this. They literally even call this rat

19:11browser in temporary files that they

19:13create. Sketch Discord token grabber. We

19:16don't need to drag us down that rabbit

19:17hole. You know exactly what that is.

19:19Same thing with Steam. We could go on

19:22and on and on for all of the potential

19:25info steeler capabilities uh with

19:28anything. Uh, Epic Games is in here just

19:30as well. So, look, that's the risk.

19:33That's the threat. Obviously, a mod, a

19:35hack, something ripping out Minecraft

19:38specific utility or information here and

19:40there, even the player location. But

19:42really, the sketchy stuff like watching

19:46your screen, monitoring your webcam,

19:48excfiltrating your passwords,

19:49credentials, or using a key logger to

19:52log everything on your keyboard, what

19:55you type in on your computer. It goes

19:57without saying this is malicious. Neat

20:00to kind of see some of the logic to

20:02register with the C2 or command and

20:04control server or framework, their

20:06external location where they're

20:07harvesting and collecting all this data,

20:10all the information about your computer,

20:12your device, files that it might rip out

20:14and exfiltrate along with those

20:16passwords, credentials, etc., etc.

20:18Couple convenience functions here. Self

20:20update. That's neat. Check shutdown.

20:23Handle different commands. Whoa, that's

20:25neat. kind of clues us into the

20:26functionality of what this could do. But

20:29obviously, it's everything that we just

20:31kind of saw, even as though they are

20:33little commands here that could be typed

20:35in. All based off Minecraft, right?

20:39The main loop though obviously is

20:41processing these commands, trying to be

20:43able to understand how this could all be

20:44used. But wow, this is of course how you

20:48actually invoke or interact with all the

20:51functionality that's defined here.

20:53Calling the functions to get your Steam

20:55login to get your Epic Games information

20:57to get all the Minecraft stuff but

21:00details behind the scenes webcam screen

21:02share key logger etc etc. Again, I just

21:06thought this was a fun one to show you

21:07because it is not obuscated whatsoever

21:09and it's just quite a ride. They are so

21:12explicit in all of the raw info of what

21:16this malware does and can do and even

21:19the comments of like, "Oh, wait for

21:21Minecraft to fully load and then use

21:23that as the remote access Trojan."

21:25Bonkers.