Is Wockyclient1.21.11-.jar.zip Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

This JAR contains 492 classes, and the scanner successfully parsed and decompiled all 492 of them. It identified 22 classes (about 4.5% of the code) with indicators worth reviewing, including network access, file access, reflection, cryptography, hardware-ID collection, and process-launching APIs.

The report also found three external destinations: wocky.lol, 164.132.47.53:8000, and a Modrinth CDN download URL. Some findings have ordinary explanations for a Minecraft client mod, such as configuration-file management, Discord Rich Presence, proxy latency checks, script loading, and license authentication. Other findings—especially downloading and replacing a JAR, launching a replacement process, collecting a hardware identifier, and a “SelfDestruct” feature—need class-level context.

One class had a decompiler anomaly, but the scanner still parsed every class and no classes failed decompilation. The evidence below matters because generic API flags alone do not establish intent.

Questions the Full Report Answers

• Does this mod make outbound connections, and where does it connect?
• Is the suspicious behavior in the mod’s own code or ordinary bundled libraries?
• Does the JAR contain signs of credential theft, remote administration, or destructive commands?
• Why does the mod collect a hardware identifier and contact wocky.lol/auth?
• Can the JAR download, replace, or alter installed mod files?

Malware and Virus Findings

No high-signal malicious behavior was detected in the form of explicit password theft, browser-token grabbing, cryptocurrency mining, ransomware behavior, or direct destruction of user files.

However, the mod’s own code contains several behaviors that deserve careful scrutiny: it obtains a hardware identifier (HWID), sends a license and HWID to an authentication server, downloads a JAR from Modrinth, writes replacement files, and uses process-launching functionality to schedule a deferred JAR replacement. These are not automatically malware, but they are more powerful than typical cosmetic or utility-mod behavior.

The report also identifies an uploadConfig method associated with an unencrypted HTTP endpoint at http://164.132.47.53:8000. The scan shows the method name, file APIs, and endpoint, but does not prove precisely what content is uploaded or when it is called.

RAT Detection

The evidence is not clearly consistent with a traditional remote-access trojan (RAT). The scan does not show a command-and-control server, hidden remote shell, remote command dispatcher, credential-stealing routine, or persistence mechanism.

That said, the JAR can launch processes and can download and replace mod files. Those capabilities could be used for legitimate self-update or “self-destruct” behavior, but they also mean the mod has a broader ability to alter its installation than a normal client-side feature mod.

Suspicious Classes and Evidence

Core JAR or Mod Code

The notable findings are in the mod’s own lol.ethane packages, rather than clearly recognizable bundled libraries. This makes the findings more relevant than generic warnings from common dependencies.

Class	Severity	Behavior	Evidence
lol.ethane.utils.auth.AuthManager	Moderate	License/HWID authentication over the network	Sends license and hwid to https://wocky.lol/auth; uses cryptography and Base64 for proof/signature handling.
lol.ethane.utils.HWIDUtil	Moderate	Collects device identifier	Uses Windows and macOS process execution plus Linux file access to derive an HWID.
lol.ethane.utils.argon.Utils	High	Downloads and replaces a JAR	Contains a fixed Modrinth JAR URL, download/write methods, and a process-based deferred replacement routine.
lol.ethane.feature.module.defined.wocky.SelfDestruct	Moderate	Removes the mod from Fabric/Mod Menu structures	Uses reflection to remove entries from Fabric Loader and Mod Menu caches.
lol.ethane.click.config.ConfigScreen	Moderate	Manages configs and references an external HTTP server	Has import/export/rename/config enumeration methods and an uploadConfig method; references http://164.132.47.53:8000.
lol.ethane.feature.module.defined.wocky.DiscordRPC	Low	Connects to local Discord IPC	Uses sockets and local pipe paths for Discord Rich Presence.
lol.ethane.utils.network.ProxyRouteManager	Low–Moderate	Stores proxy settings and measures latency	Reads/writes files and uses sockets for latency measurement.
lol.ethane.feature.scripting.registry.ScriptRepository	Moderate	Loads scripts from disk	Enumerates and loads local script files. This can be legitimate scripting support, but scripts expand the mod’s effective behavior.
lol.ethane.event.registry.EventRegistry	Low	Event-system reflection	Reflection is commonly used to register and dispatch mod events.
lol.ethane.utils.misc.SoundUtil	Low	Loads sound resources dynamically	Uses a class loader, which may be normal for resource loading.

Two additional classes in the unusual com.github namespace are especially difficult to interpret:

Class	Severity	Behavior	Evidence
com.github.WczEoi_DN	High / unresolved	Process execution and file access	Contains a main method using ProcessBuilder and Java file APIs, plus Base64-related code.
com.github.fmdjdnCfg	High / unresolved	Process execution, file/archive access, cryptography	Uses ProcessBuilder, file and archive APIs, Base64/crypto APIs, and had the only decompiler fallback/anomaly.
com.github.tco_fnrn	Moderate / unresolved	Socket networking and Base64	Contains socket-related methods with heavily unclear names.

The unusual names in these com.github classes may indicate obfuscation, generated code, or embedded components. The report does not identify them as a known normal third-party library.

Bundled Third-Party Libraries

The scan does not clearly identify common bundled libraries such as bStats, HSQLDB, SLF4J, Apache Commons IO, or HikariCP as the source of the major warnings.

The Modrinth URL points to a specific fabric-carpet JAR download. Modrinth itself is a legitimate mod-hosting CDN, but the relevant concern is that this client can download that JAR and replace a mod file through its own code.

Network Activity

The report found the following external connections or hard-coded destinations:

• https://wocky.lol/auth

  • Used by AuthManager.requestAuth(String license, String hwid).
  • The method name and evidence indicate that a license key and hardware identifier are sent for authentication.
  • Cryptographic signature verification appears to be used locally, which may be intended to validate an authentication response.

• http://164.132.47.53:8000

  • Referenced by ConfigScreen.
  • The same class includes uploadConfig(String name) and config import/export functions.
  • The report does not establish whether configuration files are uploaded automatically, manually, or what exact data is sent.
  • This endpoint uses plain HTTP rather than encrypted HTTPS.

• https://cdn.modrinth.com/data/TQTTVgYE/versions/HzPcczDK/fabric-carpet-1.21.11-1.4.194%2Bv251223.jar

  • Referenced by Utils.doDestruct().
  • The code includes download-to-path and replacement logic for JAR files.

• Discord local IPC

  • DiscordRPC uses sockets and local pipe paths to communicate with the locally installed Discord application.
  • This is expected for a Discord Rich Presence feature and is not an internet connection by itself.

• Proxy latency measurement

  • ProxyRouteManager uses sockets to measure connection latency.
  • This is consistent with a proxy-routing feature, although the report does not list its target hosts.

Deobfuscation and Analysis Coverage

The scanner achieved strong coverage:

• Classes found: 492
• Classes parsed: 492
• Classes decompiled: 492
• Classes that failed parsing: 0
• Classes that failed decompilation: 0
• Methods containing code: 3,562
• Suspicious archive entries: 0

One class, com.github.fmdjdnCfg, caused a decompiler stack-underflow fallback in one unknown method. This is a small anomaly—about 0.2% of classes—and by itself does not prove deliberate obfuscation or malicious code.

Still, that particular class is important because it also contains process execution, file/archive access, Base64, and cryptography indicators. Its unclear name and partial decompiler anomaly leave some behavior unresolved.

Is This Minecraft Mod Safe?

This appears to be a Fabric-based Minecraft client mod. The report references Fabric Loader, Mod Menu caches, a Fabric Carpet JAR download, Minecraft-style class mappings, Discord Rich Presence, configurable modules, bindings, scripts, and proxy routing.

Several features are plausible for a feature-rich Minecraft client mod:

• Saving and loading client configs and key bindings
• Discord Rich Presence
• Event registration through reflection
• Loading local scripts
• Proxy connection checks
• License authentication

The less typical features are hardware-ID licensing, a configuration upload endpoint over plain HTTP, a self-removal feature, and automatic JAR download/replacement functionality.

What Looks Normal

• Configuration storage: SaveUtil, FileUtil, and config screen methods read, write, import, export, rename, and list configuration files. These are expected for a configurable client.
• Discord Rich Presence: Local socket/pipe access in DiscordRPC is normal for integrating with Discord.
• Reflection in event and binding systems: Minecraft mods often use reflection to register events, inspect classes, or integrate with mod loaders.
• Cryptography in license verification: Base64, public keys, signatures, and cryptography can be legitimate for validating a paid-client license response.
• Modrinth CDN hosting: cdn.modrinth.com is a legitimate mod distribution domain. The concern is not the host itself, but the mod’s ability to download and replace JARs.
• Proxy latency checks: Socket usage can be expected if the mod offers proxy routing or server-latency measurement.

What Is Dangerous

• The mod collects a hardware identifier using operating-system-specific techniques, including process execution on Windows and macOS.
• It sends a license and HWID to https://wocky.lol/auth. This creates a privacy and tracking consideration even if it is used only for licensing.
• It references an HTTP configuration-related endpoint at http://164.132.47.53:8000. HTTP does not encrypt traffic, and the report cannot determine exactly what the uploadConfig method transmits.
• It includes code to download a JAR, write it to disk, and use a launched process to replace a target JAR later.
• The SelfDestruct component deliberately removes the mod from Fabric Loader and Mod Menu caches. This may be intended as a client feature, but it is not ordinary behavior for a typical mod.
• Three unusually named com.github classes use process, file, crypto, Base64, and socket APIs, with one containing the only decompiler anomaly. Their purpose is not explained by the report.

What Should You Do?

• Only use this JAR if it came directly from the developer or an official project page you trust.
• Do not use it on an account, computer, or Minecraft setup containing sensitive data unless you accept HWID-based licensing and the stated network access.
• Treat the authentication server and the HTTP config endpoint as privacy-sensitive.
• Monitor the mod’s network traffic on first launch, especially connections to wocky.lol and 164.132.47.53.
• Back up your mods folder before running it, because the JAR contains file-replacement behavior.
• Avoid supplying a license key unless you have verified the developer, the official domain, and the software’s reputation.

Scan Limitations

A static JAR scan examines code and embedded strings without running the file. It is useful for finding network endpoints, file access, process execution, and suspicious APIs, but it cannot prove that every flagged method is executed or that the JAR is completely safe.

Likewise, this report cannot determine the server-side behavior of wocky.lol, 164.132.47.53, or Modrinth-hosted content after download. Runtime monitoring and source-code review would provide stronger assurance.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A Java JAR can contain malicious code, including code that downloads files, steals data, launches commands, or communicates with remote servers. A JAR is not automatically safe just because it is a Minecraft mod.

How do I check whether a JAR file is safe?

Check its source, publisher reputation, hashes/releases, permissions-like behavior, network destinations, file modifications, and whether it launches processes. A JAR malware scanner can identify suspicious APIs, but reviewing the code and observing behavior in an isolated environment gives stronger evidence.

Can this scanner detect a Minecraft RAT?

It can detect common RAT-related indicators such as remote connections, command execution APIs, hidden downloads, persistence-like behavior, credential access patterns, and obfuscation. This report does not show a clear remote-control command system, but it does show process execution and JAR replacement capabilities that warrant review.

Does obfuscation mean a JAR is malicious?

No. Obfuscation, unusual class names, reflection, or a decompiler error can occur in legitimate software. In this report, the concern comes from the combination of unclear classes with process execution, file access, crypto/Base64 use, and a decompiler anomaly—not from the anomaly alone.

Final JAR Safety Verdict

Verdict: Use caution
Risk level: Moderate
Confidence: Moderate

Should I trust this JAR, and why? This JAR does not show direct evidence of password theft, token stealing, a remote shell, or a conventional RAT. However, its own code collects an HWID, contacts a license server, references an unencrypted configuration upload endpoint, and can download and replace JAR files using a launched process. The “SelfDestruct” feature and the unexplained com.github classes add unresolved concerns, especially because one of those classes was partially difficult to decompile. Use it only if you can verify the developer and accept its licensing, network, and self-modification behavior.