Minecraft Server C2 Investigation

Step 1: Mapping the Terrain

The investigation began by executing the tree command to map the server structure. We needed to know exactly what we were looking at before diving into the files.

We identified a specific file, net/minecraft/bundler/Main.class, sitting loose in the folder. This caught our attention immediately—it's the entry point, the first code that executes when the server starts.

Step 2: String Extraction

Searching for human-readable clues, I ran strings on the Main.class file. The output revealed highly suspicious lines that didn't look like standard Minecraft code:

Step 3: Decompilation and Logic Analysis

To understand the obfuscation, I decompiled the class file using Procyon. It was time to see the actual logic behind these updates.

The source code confirmed an XOR cipher was being used for the network activity. Crucially, I found a static key hidden in a static {} block:

Step 4: Decoding the "Java Magic"

The key 0xCAFEBABE is a standard Java magic number, but finding it manually defined as a variable is like finding a safe with the combination on a sticky note. I used CyberChef to unescape the Unicode and confirm the key.

Step 5: Extracting the Payload

Using cafebabe as the XOR key in CyberChef, I decoded the suspicious strings found earlier. One by one, the attacker's infrastructure was revealed: