r/computerviruses • u/Amogus_Mode • Jul 05 '26
File / URL Check Does this minecraft modpack have an actual virus or false positive?
I'm pretty new to this type of stuff but I got send a minecraft modpack by a friend of mine and I decided to scan it because I am a very cautious person and I was surprised to actually see all of this stuff? Did my friend try to hack me???
(UPDATE) So yeah my friend did try to hack me, and unlike how some of you guys say it wasn't someone posing as them, he really was trying to steal my account for whatever reason :| I should be fine since I kept it in the zip file right?
33
u/rifteyy_ Malware Removal Expert Jul 05 '26
That is very likely malicious indeed. It would be a very rare occasion if BD, ESET and Kaspersky were all wrong.
2
12
u/Next-Profession-7495 Jul 05 '26
Likely, but try using AnyRun sandbox. Once you run the executable in AnyRun, it will give you real-time results.
2
u/MegStuff Jul 06 '26
Is using AnyRun safe? Because there's tons of malware I've been wanting to test. Is also triage safe?
2
u/rifteyy_ Malware Removal Expert Jul 06 '26
Both are safe, yes
1
u/MegStuff Jul 06 '26
So I shouldn't be worried about the malware infecting my laptop? Cause most malware I want to test are Infostealers.
3
u/WildCard65 Jul 06 '26
As long as you don't execute them on your laptop its safe.
Both AnyRun and Triage use virtual machines specially crafted for malware detonation in order to analyze their behaviour.
1
u/MegStuff Jul 06 '26
I'm not risking clicking the exe files of stealers, unless I use those VMs
1
u/WildCard65 Jul 07 '26
I will say, malicious fake Minecraft Modpacks are gonna be hard to run on Triage and AnyRun since they usually require being loaded by a Minecraft Modloader like Fabric in order to execute.
1
u/MegStuff Jul 07 '26
The stealers I want to test aren't these types gladly, it's more like those Try my game ones and the RenEngine Loader.
1
1
10
7
4
u/BobCorndog Jul 05 '26
Drop virustotal link
Its probably malware, check if your friend is hacked and ask where he got it.
This seems related, one of the sub mods worked on this I think: https://blog.gdatasoftware.com/2026/03/38390-minecraft-mod-sugarsmp-malware
4
u/araidai Jul 06 '26
- Make sure that’s your actual friend for one.
- Ask your friend why the fuck it’s flagging that many anti-malware scans.
Why don’t you look for the actual source of that mod pack? That’s here: https://www.curseforge.com/minecraft/modpacks/all-the-mons
Why would you run a random-ass zip file?
3
u/robomikel Jul 06 '26
There is a mod for Minecraft like this. But I don’t see one appended with “fix” or with that hash. Could be he googled it and ended up on a sketchy site.
For the actual mod. Look up curse forge all the mons .
3
2
2
2
u/Tigs1112 Jul 07 '26
If it mentions “stealer”, then it’s not a false positive; even if your friends say otherwise!
1
u/muzaffer22 Jul 06 '26
Probably not your friend but the guy who stole his account sent you this. That’s why I would never trust anyone and run executables on my personal computer.
1
u/Curious_Ad2011 Jul 06 '26
Probably it wasn't even ur friend, probably ur friend got hacked and it wasn't him texting u this, btw ntts has a video on this about mod packs containing viruses and all
1
u/WildCard65 Jul 06 '26
Erik Parker has also done a video about malicious minecraft modpacks as well
1
u/boxiershelf1460 Jul 06 '26
I would tell your friend their discord account was compromised and their weren’t the person who sent that. Tell other people that they might send this to that it is malware.
1
u/Qui-e Jul 06 '26
Considering nearly half of all the detectors flagged it as malicious... i think you should immediately delete and empty your recycle bin.... and pray
1
u/No-Calligrapher4729 Jul 07 '26
The very fact its being pickup by bitdefender, kaspersky, eset and more i'm very positive that modpack contains malware.
1
u/lupaspirit Jul 07 '26
I used several antiviruses on the list that detected it as Malicious and some of them I believe did detect it is a virus and not a false positive. Even Sophos that doesn't seem to give as many false positives picked it up (they are more for business). If it is a custom mod, some will show up as riskware and a few might detect it as trojans, but everything is saying Trojan, specifically infostealers.
1
1
u/alneifkrt2 Jul 07 '26
Can you say what is the hash256 of it ? If you don't know just go to that page again at the virustotal and go to details, and if you want, tell me the hash256 so I can see more deep the infos and details about that file.
1
u/Lucifer_Death_Note Jul 08 '26
Acaso no lee que dice VIRUS.
TROJANOS .
De verdad todavía la página te dice que están contaminados con virus y todavía quieres Usarlos..
Anda úsalos.
Luego no vengas como Pndejo LLORANDO 😭, porque te han Hackeado o robado información o bloqueado tu computador...
1
u/ALostMagic Jul 09 '26
This modified atm pack has an appended mod including a malicious .exe file: https://www.virustotal.com/gui/file/dbf17fcc2ee0ac42d1d61dbac53c3cdf43ed0ceafebe8d8d5d400ccaa3954e1d/detection
1
u/Rho-9_Official Jul 11 '26
Run it against this https://rho-9-official.github.io/Rho-9_Official.github.io/
It's a project we're working on for exactly cases like this, but if it doesn't seem to flag the mod jar correctly, or you have reason to doubt the results, please reach out to us on patreon, Instagram, our threat assessment email( recon@rho-9.com),or Facebook, we'll want the mod zip in question.
0
Jul 06 '26
[removed] — view removed comment
4
1
44
u/HEYO19191 Jul 05 '26
Yes your friend tried to hack you