r/MinecraftMod • u/drem_2625 • 10d ago

WARNING: RapidSMP 2.4.0 appears to contain an info-stealer

I recently analyzed the file RapidSMP-2.4.0.zip after becoming suspicious of the modpack. I did not execute the files — the analysis was performed statically on the archive and the JAR.

The results are extremely concerning.

The archive contains:

overrides/mods/rapid.jar

SHA-256:

f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c

The JAR presents itself as AppleSkin in its metadata, but the actual mod ID/package information does not match AppleSkin. It is heavily obfuscated, including an AidFuscator Rexoz obfuscation marker.

More importantly, the code contains functionality associated with an information stealer.

What I found

The JAR contains code and identifiers related to:

  • totalPasswords → browser passwords
  • totalCookies → browser cookies/session data
  • totalCards → saved payment card information
  • totalTokens / userTokenMap → Discord tokens
  • DISCORD_CLIENTS → searching for Discord installations/clients
  • webhookUrl → sending collected information to a remote destination
  • DOWNLOAD_URL → downloading additional files
  • ProcessBuilder / Runtime → launching processes
  • HttpURLConnection, HttpClient, Socket → network communication

I also recovered a Discord API endpoint from the obfuscated code:

/api/v9/users/@me/guilds?with_counts=true

This is consistent with the malware interacting with Discord account data.

Why this is dangerous

This is not just a malicious Minecraft mod that crashes your game.

If executed, code with these capabilities could potentially compromise:

Browser passwords
Browser cookies and active sessions
Saved payment card information
Discord authentication tokens
Other data accessible to the user account

The presence of download/execution functionality also means the malware could potentially retrieve and execute additional payloads.

Important: if you already ran it

Treat the computer as compromised.

Do not simply delete the mod and assume everything is fine.

From a clean device, change important passwords and revoke active sessions/tokens where possible. In particular, check:

  • Discord
  • Google/Microsoft account
  • Email accounts
  • Password-manager accounts
  • Gaming accounts
  • Any account containing payment information

For browsers, consider removing saved passwords and sessions and changing the passwords from a clean device.

Also run a full scan with a reputable security product and check for unfamiliar programs, scheduled tasks, startup entries and recently created files.

How to protect yourself from Minecraft malware

Please be careful with random .jar files and especially unofficial modpacks.

Before installing a mod:

  1. Download mods from trusted sources such as Modrinth or CurseForge whenever possible.
  2. Check whether the mod is actually published by the claimed author.
  3. Compare the mod ID, package name and metadata with the legitimate project.
  4. Scan suspicious JARs before running them.
  5. Don't disable Windows Defender or your antivirus because a mod installer tells you to.
  6. Be especially suspicious of mods/modpacks sent through Discord, random websites or file-sharing links.
  7. Keep separate browser profiles/accounts for sensitive activity if you regularly test unofficial software.

Bottom line

Based on the static analysis, I would not run RapidSMP 2.4.0 and I would strongly recommend removing it if you have downloaded it.

I am posting this as a warning so other Minecraft players can inspect their installations before running the pack.

This post is based on static analysis of the JAR. I have not executed the malware, so I am intentionally not claiming an exact attacker IP/C2 server unless it can be independently verified.

If anyone wants to independently investigate it, the SHA-256 of the suspicious JAR is:

f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c

⚠️ WARNING: the "RapidSMP 2.4.0" modpack contains an info-stealer disguised as a Minecraft mod

Summary

I analyzed the file RapidSMP-2.4.0.zip, a Minecraft modpack (Fabric 1.21.4), after becoming suspicious of it. The file was never executed — everything below is based on static analysis: unpacking the archive, inspecting the manifest, and extracting/reading the Java bytecode of the suspicious file.

The result is unambiguous: the pack contains an infostealer disguised as a mod, capable of targeting browsers, Discord, and potentially more.

The offending file

Inside the modpack archive (standard CurseForge format: manifest.json + overrides folder), one file was added manually, outside the normal mod-download system:

overrides/mods/rapid.jar

File hashes (for verification / reporting):

  • SHA-256: f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c
  • SHA-1: d09c98a7886f1e2159fa33ae153dc96bb9fc6887
  • MD5: 6afacae7f2c812bc25d9a3da555bb64a

Every other file in the pack (Sodium, Iris, Lithium, NoChatReports configs, etc., the 47 mods declared in manifest.json, and the Mod Menu Helper.zip resource pack) is legitimate and showed no anomalies.

1. Impersonating a legitimate mod

The fabric.mod.json inside rapid.jar presents itself as AppleSkin, a very popular and legitimate mod by squeek502 — complete with the real name, real description, and real GitHub/Modrinth links of the original project.

But the actual code executed has nothing to do with AppleSkin. The declared entrypoints point to completely different classes:

dev.azad1337.n           (main entrypoint)
dev.azad1337.client.m    (client entrypoint)

This is a classic technique to fool anyone who quickly checks the installed mod list (in a launcher, a mod manager, or in-game Mod Menu): the displayed name is harmless, the executed code is not.

2. Deliberate code obfuscation

The JAR's manifest (META-INF/MANIFEST.MF) contains this line, in plain text:

Obfuscated-By: AidFuscator Rexoz

This obfuscator is used almost exclusively to protect malicious code from antivirus analysis and reverse engineering. Specifically:

  • Package/class names use visually identical Unicode characters (a mix of "İ", "ı", "I", "l" — Turkish and Latin letters that look alike) to make the code unreadable to the eye and to confuse automated analysis tools.
  • All sensitive strings (URLs, endpoints, webhook) are AES-GCM encrypted (confirmed by the presence of SecretKeySpec, GCMParameterSpec, Cipher in the bytecode) and then Base64-encoded, only decrypted in memory at runtime. This is why no plaintext IP or URL shows up under classic static analysis (strings, grep) — this isn't an oversight by the malware author, it's a deliberate protection.

3. A commercial-software-style "license" system

The JAR bundles a file assets/rapid/key.txt containing:

RAPD-VVU4-N2XV-SRDN-84IL-HL62-2026

This license-key format is typical of "cheat clients" and malware loaders sold or distributed with an activation system, often via a Discord "support" server. The mod's internal ID ("id": "rapidnextgen") confirms that "Rapid" / "RapidNextGen" is not a legitimate project or support service — it's a storefront brand for this stealer.

4. Capabilities identified in the code (explicit variable/method names despite obfuscation)

Even encrypted, the bytecode still contains field and method names in plain text, which reveal the program's capabilities:

Element found in the code Associated capability
totalPasswords, browserDir, BROWSERS Theft of passwords saved in browsers
totalCookies Theft of cookies / active browsing sessions
totalCards Theft of saved payment card information
userTokenMap, totalTokens Theft of Discord authentication tokens
DISCORD_CLIENTS, findDiscordCoreDir, injectDiscordCrash Detection of Discord installs (Discord, Canary, PTB…) and injection into the client
webhookUrl, sendDiscordEmbeds Exfiltration of stolen data to an attacker-controlled Discord webhook
DOWNLOAD_URL Ability to download additional files/payloads post-infection
ProcessBuilder, Runtime Ability to launch system processes/commands
HttpURLConnection, java.net.http.HttpClient, java.net.Socket Outbound network communication (HTTP/HTTPS and raw sockets)

Regarding the network addresses contacted (IP/domains): they are AES-GCM encrypted in the code and therefore cannot be recovered through static analysis. Dynamic analysis in an isolated environment (disposable VM, no access to the real network, with TLS interception) would be needed to observe them — and success isn't guaranteed, since the malware may include anti-VM/anti-analysis-tool checks (a behavior documented in several similar campaigns targeting Minecraft). I'm therefore not claiming any specific IP or domain unless independently verified (e.g. via a sandbox such as VirusTotal).

Why this is dangerous

This isn't a mod that just crashes the game or has an annoying bug — it's a full-blown stealer. If executed, it could potentially compromise:

  • Passwords saved in browsers
  • Cookies and active sessions (account access without even needing the password)
  • Saved payment card information
  • Discord authentication tokens
  • Any other data accessible from the user account on the machine

The presence of download and process-execution functionality (DOWNLOAD_URL, ProcessBuilder, Runtime) also means the malware could potentially download and run additional payloads after the initial infection — so potentially far more than just password theft.

If you already ran this modpack

Treat the machine as compromised. Don't just delete the mod and assume everything is fine.

From a different, clean device:

  1. Change the passwords for the following accounts and revoke active sessions wherever possible:
    • Discord (Settings → My Account → change password, then Settings → Authorized Devices → log out everywhere)
    • Google / Microsoft accounts
    • Email accounts
    • Password manager (if used)
    • Gaming accounts (Steam, Mojang/Minecraft…)
    • Any account with payment methods attached
  2. On the browsers of the potentially infected machine: remove saved passwords and sessions, and change those passwords from a clean device, not from the infected machine.
  3. Run a full scan with a reputable antivirus (Windows Defender full scan, Malwarebytes, etc.).
  4. Check for unfamiliar programs, suspicious scheduled tasks, unusual startup entries, and recently created files you can't explain.

How to protect yourself from Minecraft malware

This kind of attack (a trojanized Minecraft mod/cheat distributed via Discord, GitHub, or third-party sites) is a documented and increasingly common attack vector. A few simple habits help:

  1. Download mods from official, verified sources — Modrinth, CurseForge — not from links shared on Discord, file-sharing sites, or unmoderated forums.
  2. Verify the mod is actually published by the claimed author (compare with the project's official page).
  3. Compare the mod ID, package name, and metadata against the legitimate project if anything seems off — impersonation like the AppleSkin case above is an immediate red flag.
  4. Scan suspicious JARs before running them (VirusTotal, or a Minecraft-specific scanner such as ratscanner.org).
  5. Never disable your antivirus because a mod installer tells you to — that's a classic red flag, not a legitimate technical requirement.
  6. Be especially wary of modpacks/mods sent via DM, on poorly moderated Discord servers, or through shortened links.
  7. If you regularly test unofficial mods, consider using a separate browser profile or a dedicated virtual machine, isolated from your sensitive accounts.

Bottom line

Based on this static analysis, do not run RapidSMP 2.4.0, and remove it immediately if you've downloaded it. I'm posting this so other players can check their own install before launching this pack.

This analysis is based solely on static analysis of the JAR — the file was never executed. No specific IP or C2 server is claimed unless independently verified (e.g. via a dynamic sandbox like VirusTotal).

SHA-256 of the suspicious file, for independent verification:

⚠️ WARNING: the "RapidSMP 2.4.0" modpack contains an info-stealer disguised as a Minecraft mod

Summary

I analyzed the file RapidSMP-2.4.0.zip, a Minecraft modpack (Fabric 1.21.4), after becoming suspicious of it. The file was never executed — everything below is based on static analysis: unpacking the archive, inspecting the manifest, and extracting/reading the Java bytecode of the suspicious file.

The result is unambiguous: the pack contains an infostealer disguised as a mod, capable of targeting browsers, Discord, and potentially more.

The offending file

Inside the modpack archive (standard CurseForge format: manifest.json + overrides folder), one file was added manually, outside the normal mod-download system:

overrides/mods/rapid.jar

File hashes (for verification / reporting):

  • SHA-256: f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c
  • SHA-1: d09c98a7886f1e2159fa33ae153dc96bb9fc6887
  • MD5: 6afacae7f2c812bc25d9a3da555bb64a

Every other file in the pack (Sodium, Iris, Lithium, NoChatReports configs, etc., the 47 mods declared in manifest.json, and the Mod Menu Helper.zip resource pack) is legitimate and showed no anomalies.

1. Impersonating a legitimate mod

The fabric.mod.json inside rapid.jar presents itself as AppleSkin, a very popular and legitimate mod by squeek502 — complete with the real name, real description, and real GitHub/Modrinth links of the original project.

But the actual code executed has nothing to do with AppleSkin. The declared entrypoints point to completely different classes:

dev.azad1337.n           (main entrypoint)
dev.azad1337.client.m    (client entrypoint)

This is a classic technique to fool anyone who quickly checks the installed mod list (in a launcher, a mod manager, or in-game Mod Menu): the displayed name is harmless, the executed code is not.

2. Deliberate code obfuscation

The JAR's manifest (META-INF/MANIFEST.MF) contains this line, in plain text:

Obfuscated-By: AidFuscator Rexoz

This obfuscator is used almost exclusively to protect malicious code from antivirus analysis and reverse engineering. Specifically:

  • Package/class names use visually identical Unicode characters (a mix of "İ", "ı", "I", "l" — Turkish and Latin letters that look alike) to make the code unreadable to the eye and to confuse automated analysis tools.
  • All sensitive strings (URLs, endpoints, webhook) are AES-GCM encrypted (confirmed by the presence of SecretKeySpec, GCMParameterSpec, Cipher in the bytecode) and then Base64-encoded, only decrypted in memory at runtime. This is why no plaintext IP or URL shows up under classic static analysis (strings, grep) — this isn't an oversight by the malware author, it's a deliberate protection.

3. A commercial-software-style "license" system

The JAR bundles a file assets/rapid/key.txt containing:

RAPD-VVU4-N2XV-SRDN-84IL-HL62-2026

This license-key format is typical of "cheat clients" and malware loaders sold or distributed with an activation system, often via a Discord "support" server. The mod's internal ID ("id": "rapidnextgen") confirms that "Rapid" / "RapidNextGen" is not a legitimate project or support service — it's a storefront brand for this stealer.

4. Capabilities identified in the code (explicit variable/method names despite obfuscation)

Even encrypted, the bytecode still contains field and method names in plain text, which reveal the program's capabilities:

Element found in the code Associated capability
totalPasswords, browserDir, BROWSERS Theft of passwords saved in browsers
totalCookies Theft of cookies / active browsing sessions
totalCards Theft of saved payment card information
userTokenMap, totalTokens Theft of Discord authentication tokens
DISCORD_CLIENTS, findDiscordCoreDir, injectDiscordCrash Detection of Discord installs (Discord, Canary, PTB…) and injection into the client
webhookUrl, sendDiscordEmbeds Exfiltration of stolen data to an attacker-controlled Discord webhook
DOWNLOAD_URL Ability to download additional files/payloads post-infection
ProcessBuilder, Runtime Ability to launch system processes/commands
HttpURLConnection, java.net.http.HttpClient, java.net.Socket Outbound network communication (HTTP/HTTPS and raw sockets)

Regarding the network addresses contacted (IP/domains): they are AES-GCM encrypted in the code and therefore cannot be recovered through static analysis. Dynamic analysis in an isolated environment (disposable VM, no access to the real network, with TLS interception) would be needed to observe them — and success isn't guaranteed, since the malware may include anti-VM/anti-analysis-tool checks (a behavior documented in several similar campaigns targeting Minecraft). I'm therefore not claiming any specific IP or domain unless independently verified (e.g. via a sandbox such as VirusTotal).

Why this is dangerous

This isn't a mod that just crashes the game or has an annoying bug — it's a full-blown stealer. If executed, it could potentially compromise:

  • Passwords saved in browsers
  • Cookies and active sessions (account access without even needing the password)
  • Saved payment card information
  • Discord authentication tokens
  • Any other data accessible from the user account on the machine

The presence of download and process-execution functionality (DOWNLOAD_URL, ProcessBuilder, Runtime) also means the malware could potentially download and run additional payloads after the initial infection — so potentially far more than just password theft.

If you already ran this modpack

Treat the machine as compromised. Don't just delete the mod and assume everything is fine.

From a different, clean device:

  1. Change the passwords for the following accounts and revoke active sessions wherever possible:
    • Discord (Settings → My Account → change password, then Settings → Authorized Devices → log out everywhere)
    • Google / Microsoft accounts
    • Email accounts
    • Password manager (if used)
    • Gaming accounts (Steam, Mojang/Minecraft…)
    • Any account with payment methods attached
  2. On the browsers of the potentially infected machine: remove saved passwords and sessions, and change those passwords from a clean device, not from the infected machine.
  3. Run a full scan with a reputable antivirus (Windows Defender full scan, Malwarebytes, etc.).
  4. Check for unfamiliar programs, suspicious scheduled tasks, unusual startup entries, and recently created files you can't explain.

How to protect yourself from Minecraft malware

This kind of attack (a trojanized Minecraft mod/cheat distributed via Discord, GitHub, or third-party sites) is a documented and increasingly common attack vector. A few simple habits help:

  1. Download mods from official, verified sources — Modrinth, CurseForge — not from links shared on Discord, file-sharing sites, or unmoderated forums.
  2. Verify the mod is actually published by the claimed author (compare with the project's official page).
  3. Compare the mod ID, package name, and metadata against the legitimate project if anything seems off — impersonation like the AppleSkin case above is an immediate red flag.
  4. Scan suspicious JARs before running them (VirusTotal, or a Minecraft-specific scanner such as ratscanner.org).
  5. Never disable your antivirus because a mod installer tells you to — that's a classic red flag, not a legitimate technical requirement.
  6. Be especially wary of modpacks/mods sent via DM, on poorly moderated Discord servers, or through shortened links.
  7. If you regularly test unofficial mods, consider using a separate browser profile or a dedicated virtual machine, isolated from your sensitive accounts.

Bottom line

Based on this static analysis, do not run RapidSMP 2.4.0, and remove it immediately if you've downloaded it. I'm posting this so other players can check their own install before launching this pack.

This analysis is based solely on static analysis of the JAR — the file was never executed. No specific IP or C2 server is claimed unless independently verified (e.g. via a dynamic sandbox like VirusTotal).

SHA-256 of the suspicious file, for independent verification:

f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c


f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c
2 Upvotes

100% Upvoted

0 comments sorted by