Leaf Leaf Mod Analyzer

Telegram Bot / Channel C2 Link

Telegram_Link Malware LOW +1 score

🎮 Minecraft Gameplay Impact

Many developers and modding teams maintain official community channels on platforms such as Discord, Telegram, or Matrix to publish change logs, support requests, and release announcements.

Telegram_Link identifies class files that store t.me/ link literals. In the inspected sample from ru.pulse.Pulse, the modification executes a method (runtimeBrandingTick()) that modifies the GLFW game window title to include promotional attribution, checks a system property flag, and forcibly launches the player's default web browser to open two Telegram channels via Desktop.getDesktop().browse(). If the desktop API is unavailable, it invokes a Windows system command (rundll32 url.dll,FileProtocolHandler) as a fallback.

While this mechanism does not constitute a command-and-control (C2) backdoor or data-stealing channel, unsolicited browser redirection during game startup disrupts the player experience and forces promotional web traffic without explicit user action.

🔍 Functions & APIs Analyzed

ConstantPool CONSTANT_Utf8

String literal containing a t.me or telegram.me URL address.

⚙️ Decompiled Representation (Vineflower View) 

public static void runtimeBrandingTick() {
   try {
      Object var0 = Class.forName("net.minecraft.client.MinecraftClient").getMethod("getInstance").invoke(null);
      Object var1 = var0.getClass().getMethod("getWindow").invoke(var0);
      Long var2 = (Long)var1.getClass().getMethod("getHandle").invoke(var1);
      Class.forName("org.lwjgl.glfw.GLFW")
         .getMethod("glfwSetWindowTitle", long.class, String.class)
         .invoke(null, var2, "<redacted_branding_text>");
   } catch (Throwable var6) {
   }

   try {
      if (System.getProperty("pulse.telegram.links.opened") == null) {
         System.setProperty("pulse.telegram.links.opened", "true");

         try {
            if (Desktop.isDesktopSupported()) {
               Desktop.getDesktop().browse(new URI("hxxps://t[.]me/<redacted_channel_1>"));
               Desktop.getDesktop().browse(new URI("hxxps://t[.]me/<redacted_channel_2>"));
               return;
            }
         } catch (Throwable var4) {
            // ...
         }

         try {
            Runtime.getRuntime().exec(new String[]{"rundll32", "url.dll,FileProtocolHandler", "hxxps://t[.]me/<redacted_channel_1>"});
            Runtime.getRuntime().exec(new String[]{"rundll32", "url.dll,FileProtocolHandler", "hxxps://t[.]me/<redacted_channel_2>"});
         } catch (Throwable var3) {
            // ...
         }
      }
   } catch (Throwable var5) {
   }
}

🛡️ Bytecode Signature & Static Detection

The detector inspects string constants in the class constant pool (CONSTANT_Utf8) for URLs matching Telegram domain formats:

https?://(?:t(?:elegram)?\.me)/[a-zA-Z0-9_]+

The rule flags the presence of Telegram link strings within compiled class constants. The primary technical limitation is that the check evaluates the string pattern alone: it does not determine how the link is used (e.g., whether it is an informational author link on a menu, an automated browser launch upon startup, or an endpoint for data exfiltration).