Possibly Infected AstraClient (Hypixel Client, Intave Client) LEAKED

[AnonymeSchumacher]

Developer: Elias Schumacher aka crypt

Download: https://workupload.com/file/X5vmPfz9nqp

 

[xkeksbyte]

"intave client" nice joke

 

[EcstasyUwU]

nice tokengrabber (godecho momento)

 

[Gelöschtes Mitglied 70]

Hello!

According to the source it's a rename of another client called BlockClient.

private final String prefix = "§eBlockClient §8× §7";

and later in the code you see something similar to that

public void sendMessage(String message) {
  BlockClient blockClient  = new BlockClient();
  if (blockClient.getPlayer() == null) {
    return;
  }
  blockClient.getPlayer().addChatMessage(new ChatComponentText(String.valueOf(new StringBuilder().append("§eAstraClient §8× §7").append(message))));
}

I will keep this thread as "Possibly Infected".

Reasons for that is the following file: DiscordSender it is still unclear what information it sends to the webhook, it can also be used to raid a server.

Have a fantastic day
Krypton



PS: The source code has been checked with a tool and is not 100% accurate, use the JAR at your own risks, we are not responsible of eventual damages.

 

[EcstasyUwU]

Hello!

According to the source it's a rename of another client called BlockClient.

private final String prefix = "§eBlockClient §8× §7";

and later in the code you see something similar to that

public void sendMessage(String message) {
  BlockClient blockClient  = new BlockClient();
  if (blockClient.getPlayer() == null) {
    return;
  }
  blockClient.getPlayer().addChatMessage(new ChatComponentText(String.valueOf(new StringBuilder().append("§eAstraClient §8× §7").append(message))));
}

I will keep this thread as "Possibly Infected".

Reasons for that is the following file: DiscordSender it is still unclear what information it sends to the webhook, it can also be used to raid a server.

Have a fantastic day
Krypton



PS: The source code has been checked with a tool and is not 100% accurate, use the JAR at your own risks, we are not responsible of eventual damages.

Sus Class ->

View attachment 164

Webhook got deleted because i spammed the webhook

(https://discord.com/api/webhooks/83...ZXTortaVviThptL6AOgpTi5vBmhGuiASMB6zAcYVup1FI)

Sends a Webhook ->
View attachment 163

oh:

lIlIIIllIllIlI[lIlIIIlllIIIll[3]] = llIIIIIIIlIIlII("uaS2/V/UiwIIEERnwPsxpOZHeD2G/T/ua+xw6SkirYPILGjxm3JSu5H4gw+XaHcn", "IlSXM");

string:
/AppData/Roaming/Discord/Local Storage/leveldb/

:thonk:

 

[Gelöschtes Mitglied 70]

Sus Class ->

View attachment 164

Webhook got deleted because i spammed the webhook

(https://discord.com/api/webhooks/83...ZXTortaVviThptL6AOgpTi5vBmhGuiASMB6zAcYVup1FI)

Sends a Webhook ->
View attachment 163

oh:

lIlIIIllIllIlI[lIlIIIlllIIIll[3]] = llIIIIIIIlIIlII("uaS2/V/UiwIIEERnwPsxpOZHeD2G/T/ua+xw6SkirYPILGjxm3JSu5H4gw+XaHcn", "IlSXM");

string:
/AppData/Roaming/Discord/Local Storage/leveldb/

:thonk:

Yup, have seen that the Webhook was unknown, so will still keep it as Possibly Infected.

 

[ENDERMANQ_PL]

can anyone give the deobfscated version that would work?

 

[EcstasyUwU]

LMAOOO