Minecraft Mod Builds a Malware-Analysis Workflow Around MWDB
· 25:58 · Watch on YouTube ↗
Summary
A prototype Minecraft mod visualizes files from open directories and moves samples toward MWDB for analysis. The stream shows sandbox and integration problems, including collected Bash history and an API key, while weighing persistent storage against disposable VMs.
Key points
- The mod uses the hunt[.]io API to display files from internet open directories as Minecraft creatures; the files may include malware, exploit code, and proof-of-concept payloads.
- The project aims to download selected files into a controlled VM sandbox for analysis, but the sandbox connection and in-game download flow remain unreliable.
- MWDB is set up as a repository for samples, hashes, tags, metadata, and relationships.
- The discussion distinguishes a persistent artifact repository from disposable analysis VMs, noting that VM rollback could erase collected evidence if storage is kept inside the sandbox.
- A downloaded sample included someone’s Bash history and an API key; the speaker said the key was not his, and the source of the exposed material was not established.
- By the end, MWDB was running, but downloading files from the game and ingesting them reliably still required work.
Article Details
- Topics
- [00:00] Building a Minecraft mod to visualize files from open directories for cybersecurity research
- [03:06] Testing file downloads and VM sandbox control, including credential-handling problems
- [09:24] Using MWDB to organize malware samples, hashes, metadata, and relationships
- [14:31] Separating persistent sample storage from disposable analysis VMs to avoid losing evidence on rollback
- [19:45] Testing sample ingestion and encountering collected Bash history and an API key
- [21:45] Remaining work on reliable downloads, sandbox control, and MWDB ingestion