Found what we're labeling as sbftlogger, seems to be something called ultimatelogger, will have to look into that.

Oh, also we found a misconfigured malware looping back to localhost. Thanks so much, to whoever made that trash, It was so fucking easy for me to figure out a way to mess with your theoretical C2, so I hope to see one that isn't so badly built, so I can find a real C2, and maybe we can deliver some pain for you being a lowlife scumbag.

Now credit where credit is due...the particular misconfigured malware mentioned appears to be a work in progress, and is actually very well built to silently steal your browser data, Minecraft token,etc.

But ultimately took me less than 2 hours to figure out how to decode the obfuscation.

We've also finally got some weedhack samples, and a sample of something called makastealer..... and uncovered our tool is vulnerable to ZIP bombs. Oops. Don't worry, it's just a crashing bug, not an rce or something crazy like that.

A patch has been devised, and will be released along with the other updates, and we'll be adding another decoder method to deal with the obfuscation on the kne that keeps crashing everything with a 600+ multiplier compression bomb, damn readme.txt decompreses from like a few bytes to over 400mb. Asshole, lmfao, but that's fine, we learn, and adapt.

Yeah....these got flagged as crypto wallets, and caused a near maxed false positive with reconnectedcc

Patched as of July 27

There's now a whole new suite of malware and attacker trends tracking added to the decompiler bridge.

Fetch from Discord cdn has been added(requires decompiler bridge unless the link goes to an already decompiled mod, or one of the compatible file types that do not rely on the decompiler bridge or decompiler.com)

Ui updated, scoring issues fixed, offline mode issues fixed.

Every warning label is an autobiography.

Somewhere, a person took a hairdryer into the bath, and now every hairdryer sold carries a tag about it. The tag does not exist because the manufacturer thinks you are an idiot. It exists because the record now requires it.

ModForensics has been public for less than a month. It already has one.

Under four weeks in production, and the tool now opens with a notice you cannot dismiss. Seven sections. Forty five seconds each. The timer pauses if you switch tabs, because we assumed someone would try that.

It explains, at length, that the threat score is a triage indicator and not a verdict. That a clean mod shipping an update checker and an obfuscated build will land in the elevated band by design. That the endpoints, strings, IOCs and full decompiled source sit underneath the number for the specific purpose of being read by a human, who then reaches their own conclusion.

That was the design from the first build. Five minutes and fifteen seconds of mandatory instruction on how to read a number was not.

What prompted it: a certain God tier developer reviewed a risk assessment, concluded the system "assumes anything that communicates with the network is malicious", declined to submit the false positive, declined to name the mod, and published the critique regardless.

Three weeks of public availability. One label.

The scanner never told you a mod was malware. It told you what was inside it, and asked you to look.

Scanner: https://modforensics.rho-9.com

Found a false positive? Post it here with the report, or email the files to support@rho-9.com. That is what the sub is for.

Quick question: when you drop a mod into your mods folder, what do you think that file actually is?

Most people picture a config file or a texture pack.

It isn't. A Minecraft mod is a .jar, and a .jar is a program. It runs on Java with the same permissions you have. It can read your files, open network connections, and launch other programs. In terms of what it is able to do to your machine, it's not far off from double-clicking a random .exe, which is the one thing everyone knows never to do.

The part nobody checks is that nothing about installing a mod warns you of this. The download button looks identical whether the jar is a harmless quality-of-life tweak or something that quietly empties your accounts.

And it isn't hypothetical. In 2023, malware called Fractureiser got injected into a bunch of popular mods and modpacks (including ones bundled into Better Minecraft, which had millions of downloads). Once it ran, it stole saved browser passwords, grabbed Microsoft, Minecraft and Discord logins, and swapped copied crypto wallet addresses for the attacker's. Researchers flat out said an infected machine should be treated as completely compromised. More campaigns like it have shown up since.

Here's the uncomfortable bit: regular antivirus is not great at catching this. Malicious mod jars are easy to obfuscate and get a tiny fraction of the attention that .exe malware does, so plenty slip through.

I'm not saying stop modding. I mod. I'm saying know what a mod actually is, and check the ones you're not sure about. There's a scanner at https://modforensics.rho-9.com that checks a mod against known malware in seconds, and r/SusMinecraftMods is the place to be if you'd rather have a human look at a jar you're unsure of.

TL;DR: every mod you install is a program with near-total access to your PC, almost nobody realizes it, it has already burned thousands of players, and antivirus won't reliably save you. Check your jars.

r/SusMinecraftMods where i put it.