He Sent Me Minecraft Malware (Java Deobfuscation)

WATCH MORE:

🔥YOUTUBE ALGORITHM ➡ Like, Comment, & Subscribe!

[Toadstar]

Hey! Hypixel Skyblock YouTuber here,

Thanks for looking at this! The Hypixel community has been overwhelmed with fake mods, and session stealers for years.
I’m glad more people are looking at this, and helping to spread awareness about fake mods, and the dangers of them.

Love seeing stuff like this. Thanks for the fun watch!

[vanillarodent]

Needed that sublime select thing at work today thank you

[davidarthurcole]

Hey John! Thanks so much for looking at this sample I sent. Interesting to see how you did things differently and the same as I did in my initial analysis.

[Deftera]

25:14 I've been rick rolled too much by now to recognize this regex.

[uxiii]

As a player of hypixel skyblock. RAT's are really common. You can find multiple in a week depending on what you do.

[rudigerheissich]

best part was the indirect java roast (but loved the other two minutes as well)

[sojiro]

"Java is just stupid and annoying." -John as well as every Java dev.

[ffakkee]

Thought it was worth pointing out that Recaf is a good tool for those who decompile, deobfuscate, and reverse engineer java/minecraft mods. It allows you to rename variables, edit bytecode, and run methods with dummy inputs without ever even unzipping the jar

[Sollace]

17:57 This is likely a decompilation error. I don't know why you're not using a proper IDE for this. Would probably chop about 15 minutes off the video length.

[DChad-pt]

25:21 Pizza Client is another minecraft mod for hypixel skyblock. It comes built in with a feature to protect against session id stealing which is when another mod like the one showcased steals the session id used to log into the users minecraft account. This string is there to find that part of the mod and presumably disable the feature in order to not get detected.

[MatinDevs]

Imagine spending this MUCH time making an info stealer to get people's lunar client accounts

[questwalkerko]

Spent 20 minutes doing nothing, then just uses ChatGPT and ends the video :/
Would've been more interesting to see some of the obfuscation techniques... I wish I could just access the code myself.

[GandhiTheDerg]

Just using an actual Java IDE would probably make it much much easier LMFAO

[nemesician_]

"I do know maybe LITTLE bit about malware"
-John Hammond 2024

[ai-spacedestructor]

i assume that in "qolskyblockmod" the "qol" stands for "Quality of Life" as in useful additions that make it more enjoyable without making gameplay changes to the Skyblock mode that the mod is for.
some of the odd client names are most likely some obscure minecraft launchers i havent heard of before.
I do recognize essentials as a legitimate minecraft mod tho where they are probably trying to extract data from since its adding social mechanics like friends list, joining friends etc. like your used to from steam to the game.
I assume internal those systems store some data an info stealer would be interested in since the user basically already willingly gave those informations out.

[ishino_ki]

OKAY JOHNNY YOU'RE GOING DOWN FOR CALLING JAVA STUPID (in all seriousness, great video, keep it up 😉)

[hydos]

Hey man, JD-Gui is a pretty out of date decompiler. You should look into using a decompiler such as fern flower or vine flower (a fork of fern flower) instead which can (sometimes) be faster and provide more accurate and readable code

[AACraft]

finally another malware deobfuscation video, they are so interesting

[shadowplay]

I was once setting up my laptop to host a Minecraft server and I kid you not, it took 3 DAMN HOURS to get the correct version of java and their JDK's, JDE's. I was on like 10 Different websites. java is just so difficult to deal with so I can understand your struggle with javaFX and such stuff.

[callummcclure]

Not even Minecrafters are safe from malware....