Is NightWhisper-1.4.2.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

The deep scan inspected all 438 classes in NightWhisper-1.4.2.jar. All classes were successfully parsed, although decompilation failed for 5 classes. The scanner identified 4 suspicious classes, representing about 0.91% of the JAR, along with 7 classes showing decompiler or obfuscation anomalies.

The important findings are concentrated in the JAR’s own dev.nightwhisper code. These include access to Discord and Minecraft session data, uploading collected information, remote shell and screenshot commands, downloading and executing a native payload, and creating startup persistence. A separate finding in org.bstats.fabric.Metrics is consistent with ordinary anonymous telemetry, but it does not explain the other behavior.

Questions the Full Report Answers

• Does the JAR access Discord tokens or Minecraft launcher session files?
• Does it upload collected account information to an external server?
• Does it provide remote command, file-upload, and screenshot capabilities?
• Does it download an executable and configure itself to start automatically?
• How much of the JAR was inspected, and which classes had decompiler anomalies?

Malware and Virus Findings

The scan detected multiple high-signal behaviors:

• Credential theft: SessionHarvester reads Discord token storage and Minecraft launcher account/session files.
• Credential exfiltration: The collected values are Base64-encoded and sent to night-sync.example.
• Remote command execution: RemoteConsole accepts commands through an encrypted WebSocket and uses Runtime.exec to run shell commands.
• File and screen access: The remote channel reportedly supports file uploads and screenshots.
• Hidden payload download: UpdateService downloads a native executable disguised as an update.
• Execution and persistence: The downloaded payload is executed and added to the current user’s startup folder.

These are not merely generic scanner indicators. Together they describe credential theft, remote control, payload execution, and persistence.

RAT Detection

The evidence is strongly consistent with a remote-access trojan (RAT) or RAT-like functionality. The RemoteConsole class opens a remote control channel, accepts shell commands, supports file uploads and screenshots, and executes commands through Runtime.exec.

The downloaded executable and startup-folder entry further indicate an attempt to maintain access after the JAR is run.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class	Severity	Behavior	Evidence
dev.nightwhisper.client.SessionHarvester	Critical	Credential collection and exfiltration	Reads Discord token storage and Minecraft launcher session files, Base64-encodes values, and POSTs them to night-sync.example/api/session.
dev.nightwhisper.client.RemoteConsole	Critical	Remote control and command execution	Opens an encrypted WebSocket to night-control.example/socket, accepts shell commands, file uploads, and screenshots, and invokes Runtime.exec.
dev.nightwhisper.bootstrap.UpdateService	Critical	Payload download, execution, and persistence	Downloads a native executable disguised as a cache update, executes it, and creates an autostart entry in the user startup folder.
dev.nightwhisper.bootstrap.UpdateService	High	Obfuscation around dangerous behavior	Uses heavily obfuscated strings and reflection around process execution; its applyUpdate() method received an obfuscation score of 94.

Bundled Third-Party Libraries

Class	Severity	Behavior	Evidence
org.bstats.fabric.Metrics	Low	Anonymous usage telemetry	Submits standard anonymous mod statistics to bStats.
org.apache.commons.io.FileUtils	Informational	Complex file utility code	Two methods required decompiler fallback; no malicious behavior was identified in the supplied evidence.

The bStats class is not the reason for the serious findings. The critical behavior appears in the JAR’s own dev.nightwhisper classes rather than being limited to a bundled third-party library.

Network Activity

The report identifies these outbound connections:

• night-sync.example — unexplained upload destination for collected Discord and Minecraft session data.
• night-control.example — encrypted remote command channel for shell commands, file uploads, and screenshots.
• bStats.org — standard anonymous metrics endpoint used by the bundled bStats library.

The first two connections are not ordinary update checks or normal game-feature requests according to the report. They are directly associated with credential theft and remote control.

Deobfuscation and Analysis Coverage

• Classes in JAR: 438
• Classes parsed: 438
• Parse failures: 0
• Classes decompiled: 438 attempted
• Decompile failures: 5
• Decompiler anomaly classes: 7
• Suspicious classes: 4
• Suspicious class ratio: 0.91%

The scan inspected nearly all of the JAR successfully. Five decompilation failures and several anomalies limit visibility into a small amount of code, but they do not materially weaken the findings because the report already identifies multiple explicit malicious behaviors in successfully analyzed classes. The UpdateService class is especially concerning because it combines heavy string obfuscation with process execution and persistence.

Is This Minecraft Mod Safe?

No. The report identifies a Fabric mod that reads Minecraft account/session files, accesses Discord token storage, uploads collected data, opens a remote command channel, downloads an executable, and creates startup persistence.

Do not install or run it on a system containing active game accounts, Discord sessions, personal files, or important credentials.

What Looks Normal

• The bundled org.bstats.fabric.Metrics class appears consistent with standard anonymous mod telemetry.
• The presence of a bundled library such as Apache Commons IO is normal.
• The JAR’s size and large class count are not inherently suspicious.
• The fact that all classes parsed successfully is a positive scan-coverage detail, but it does not make the identified behavior legitimate.

What Is Dangerous

• Reading Discord token storage.
• Reading Minecraft launcher account and session files.
• Uploading collected credentials to an external server.
• Providing a remote shell and command-execution channel.
• Supporting remote file uploads and screenshots.
• Downloading and executing a native payload.
• Creating an autostart entry for persistence.
• Obfuscating the update and process-execution logic.

These behaviors are directly associated with credential theft, remote control, and maintaining access to the computer.

What Should You Do?

1. Do not run or install this JAR.
2. If it has already run, disconnect the affected computer from the internet.
3. Change Minecraft and Microsoft account passwords from a separate, trusted device.
4. Revoke active Minecraft/Microsoft sessions and rotate or revoke Discord tokens.
5. Check the user startup folder and installed programs for recently created files.
6. Run a reputable antivirus or endpoint-security scan and inspect for unknown native executables.
7. Treat credentials used on the affected system as potentially exposed.

Scan Limitations

Static JAR scanning examines the file’s code and indicators but cannot prove complete safety or determine every runtime action. It may miss behavior hidden behind encryption, dynamic loading, or environment-specific triggers. In this case, however, the report contains several explicit and mutually reinforcing indicators of credential theft, remote control, payload execution, and persistence.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A JAR can contain Java malware, credential stealers, remote-control functionality, downloaders, or code that launches native executables. This report identifies several of those capabilities.

How do I check whether a JAR file is safe?

Use a reputable scanner, inspect the publisher and download source, compare hashes where an official hash is available, and review suspicious classes and network destinations. Do not rely on a clean antivirus result alone, especially for unofficial mods.

Can this scanner detect a Minecraft RAT?

It can identify code patterns associated with RATs, such as remote command channels, shell execution, screenshots, file transfer, and persistence. This report contains those indicators in RemoteConsole and UpdateService.

Does obfuscation mean a JAR is malicious?

No. Obfuscation can be used for legitimate intellectual-property protection. However, heavy obfuscation around process execution and payload updates is especially concerning when combined with credential theft and remote control, as it is here.

Final JAR Safety Verdict

Verdict: Do not trust
Risk level: Critical
Confidence: High

Should I trust this JAR, and why? No. The JAR contains code that collects Discord and Minecraft session data and uploads it externally. It also provides remote shell control, screenshots, file uploads, executable payload downloading, and startup persistence. The small amount of normal bStats telemetry does not offset these critical behaviors, and the evidence is strong enough that the JAR should be removed and treated as malicious.