File scan report
Verdict Safe
Is meteor-
No antivirus engine detected this moderately circulated JAR, and its sandbox run produced no malicious verdict, network contacts, or confirmed malicious child.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the project's own website.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 53 flagged
- Flagged 0
- No detection 53
- No result 21
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The sample received no malicious or suspicious detections from 74 antivirus engines, including no major detections. One sandbox run exposed two potentially offensive techniques, but produced no malicious verdict or observed network contacts; protection should remain enabled when testing or installing it.
The strongest signal is the complete absence of malicious and suspicious detections across 74 engines, with nine major antivirus engines reporting no detection. The JAR has also circulated through 92 sources over 247 days without accumulating a known threat label. One sandbox run mapped activity to and T1562.001, but recorded no persistence indicators, malicious sandbox verdict, or network contacts. Seven written or dropped files were inspected without a confirmed malicious child, although their individual verdicts remain unknown. Host-reputation checking was not completed, so no broader claim about network reputation can be made.
What We Detected
None of the 53 antivirus engines that checked it flagged the JAR as malicious or suspicious. The file has been submitted 93 times by 92 sources over 247 days without gaining a recognized malware family label.
Threat Behavior
One completed sandbox run associated activity with T1543.002 and T1562.001, which can relate to service manipulation and impairment of defenses. However, the run produced no malicious sandbox verdict, no persistence indicators, and no observed domain, IP, or URL contacts. Seven children were inspected without a confirmed malicious result, but their individual verdicts remain unknown. A complete contacted-host reputation check was not available.
What To Do Now
Obtain the add-on from its official project or release channel and verify its SHA-256 hash before use. Keep security software enabled, and test it in an isolated Minecraft profile if its provenance is uncertain.
Where this verdict could be wrong4 caveats
- The completed sandbox associated the run with and T1562.001, techniques that can indicate service manipulation or impairment of defenses.
- All seven files it created have unknown verdicts, so the absence of a known-malicious dropped file does not establish that each child is benign.
- The missing contacted-host reputation result means no complete host-reputation cross-check was available.
- Eleven of the 53 antivirus engines that checked it timed out, including Avast, AVG, BitDefender, and Kaspersky, limiting the strength of the otherwise broad detection result.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/53 engines reported malicious or suspicious results.
- No major antivirus engines flagged it and 9 major antivirus engines reported it clean.
- No sandbox returned a malicious verdict.
- No domains, IP addresses, or URLs were observed during the completed sandbox run.
- No dropped file is known to be malicious.
- Sandbox mapping included and T1562.001.
- Complete contacted-host reputation coverage was unavailable.
- Eleven antivirus engines timed out.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 3spawned processes
- 0network contacts
- 14filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1064
- T1082· System recon
- T1106
- T1202
- T1518.001· Checks your AV
- T1543.002· Service install
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.001· Hides artifacts
- T1564.003· Hides artifacts
Observed activity
Processes started
3Programs the file ran, with their command lines.
java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\sample.jar"cmd.exeC:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\download.jar"" >> C:\cmdlinestart.log 2>&1java.exe"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\download.jar"
Files
14Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\6800 - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp - Written
C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user - Written
C:\Users\user\AppData\Local\Temp\hsperfdata_user\2928 - Written
C:\cmdlinestart.log
Show all 14 entries for files
- Written
\Device\ConDrv\\Connect - Written
/proc/4976/coredump_filter - Written
/tmp/hsperfdata_root/4976 - Written
/var/log/auth.log.1.gz - Written
/var/log/kern.log.1.gz - Written
/var/log/syslog.1.gz - Deleted
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6848 - Deleted
/tmp/hsperfdata_root/4976
Sandbox background — not the file
12The analysis machine's own processes and connections, recorded in every run.
- VM process
icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
sh/bin/sh sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " - VM process
invoke-rc.d/usr/sbin/invoke-rc.d invoke-rc.d --quiet cups restart - VM process
runlevel/sbin/runlevel - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-enabled cups.service
Show all 12 entries for sandbox background — not the file
- VM process
ls/usr/bin/ls ls /etc/rc[S2345].d/S[0-9][0-9]cups - VM process
systemctl/usr/bin/systemctl systemctl --quiet is-active cups.service - VM process
gzip/bin/gzip - VM process
sh/bin/sh sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog - VM process
rsyslog-rotate/usr/lib/rsyslog/rsyslog-rotate - VM process
systemctl/usr/bin/systemctl systemctl kill -s HUP rsyslog.service
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 14e7f121e0db42ca3cd3…945192Not checkedno saved verdict
- 293483f06318c559a2a4…cdf399Not checkedno saved verdict
- d997d4c933c09d2ff0cc…22626cNot checkedno saved verdict
Chapter 04
Technical details
None of the 53 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 8, 2026, 3:42 PM UTC
- SHA-256
dc7b3bbb8b2852369a8568bcf66db55208459c085300f1d5a7a68e82c93da7b6- SHA-1
de799e94474784462445fa58c5b3a75b81298470- MD5
83d2c91f427d6937497acc7ec16ebb6e
About this file
meteor-satellite-addon-1.21.11-2.jar is a JAR file of 382.6 kB.
- Type and size
- JAR · 382.6 kB
- Signer
- Not applicable
- First seen
- Jan 5, 2026On VirusTotal.
- Submitted by
- 92 distinct sources
First scanned
Antivirus consensus
0 of 53 engines flagged this file
21 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-110 engines0flagged
- Tier-230 engines0flagged
- Low-trust13 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacNo result
- Antiy-AVLClean
- APEXNo result
- ArcabitNo result
- AvastNo result
- Avast-MobileClean
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXNo result
- CylanceNo result
- CynetClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataNo result
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is meteor-satellite-addon-1.21.11-2.jar safe?
What is meteor-satellite-addon-1.21.11-2.jar?
How many antivirus engines detected meteor-satellite-addon-1.21.11-2.jar?
What is the SHA-256 hash of meteor-satellite-addon-1.21.11-2.jar?
Is it safe to open or run meteor-satellite-addon-1.21.11-2.jar?
How up to date is this analysis of meteor-satellite-addon-1.21.11-2.jar?
Community
Member reviews and reports for this exact file hash.