Unknown⠀ Astralis 2.11 free by Drcrypter

# Astralis free 2.11 (drcrypter) — Static Analysis Report
**Analyst:** ollie (static only, nothing executed on host)
**Date:** 2026-11-10
**Subject:** `astralis.exe` + `launcher-settings.json`
**Method:** PE parsing, KAX container parse, ZIP extraction, zstd decompress, GraalVM native-image analysis, class-file carving, string/IOC sweep, IDA Pro MCP decompilation of the outer launcher.
---
## 1. Verdict
**No RAT. No webhook. No cookie logger. No token logger. No wallet/Steam stealer. No persistence.**
The package is exactly what it advertises: an **offline free** of the paid Minecraft cheat client
*Astralis* (recode / Serenity runtime), repackaged as a GraalVM **native image** with the
licence/protection layer removed. It is a game cheat, not a stealer.
Residual risk is **cheat-client risk**, not malware risk: it is a kernel-adjacent game cheat that
talks to Hypixel, and it ships an anti-dump / anti-debug monitor. That is the client's own DRM
leftover, not a payload.
---
## 2. Artifact hashes
| File | Size | SHA-256 |
|---|---|---|
| `astralis.exe` | 1,325,867,008 | `20D030EFEBC8A73E50C8AB0FE60A5ABA487FD11C617C8B68521A76DC584CBF4F` |
| `launcher-settings.json` | — | `12BBBDCFD23F73280653CED4C6D2DD88C2AA673F30794C1914CF96BA04BDA56D` |
| `compiled_launcher.dll` | 6,786,048 | `E6D1A5269F5A0353CA075D3DFEA65C059BF58F0BD10A92AB0A3178DCB98FFE96` |
| `Runtime/serenity-client-host.exe` | 468,648 | `4068F524E72CFD8479ED570967AE3DE105EA742794FE51ECD5127D5F29EC80C3` |
| `Runtime/astralis.dll.zst` | 685,406,607 | `C146ADB65121D458BBE9C59D060AF94DAD6A5284D527884A376DEB9B32708729` |
| `Runtime/astralis.dll` | 1,933,864,960 | `F2168FC4BDCFC7E0EE5904085F2EAABDADDA4799DBCAF308936DE0E58A1B10D0` |
---
## 3. Loader chain
```
astralis.exe MinGW x64 GUI, imagebase 0x140000000
│ imports: CreateProcessW, LoadLibraryExW, AddDllDirectory,
│ OpenProcess, K32GetModuleFileNameExW, CreateFileMappingW,
│ VirtualProtect, SHFileOperationW
│
├─ .rdata[0x11050] = "KAX" self-extracting container (1,325,851,756 bytes, 22 records)
│ record = UTF-16LE NUL-terminated name + u64 LE size + raw data
│
├─ compiled_launcher.dll Nuitka-compiled Python 3.12 launcher, exports run_code
├─ python312.dll + 20 pyd/dll CPython 3.12 runtime (zstandard, ssl, hashlib, ctypes, wmi…)
└─ payload.dat 1,302,347,923-byte ZIP, 5,930 entries, 1,619,400,025 uncompressed
├─ Runtime/ 200 entries — JDK 25.0.4.1 image + natives
│ ├─ astralis.dll.zst 685 MB zstd → astralis.dll (1.93 GB GraalVM native image)
│ ├─ serenity-client-host.exe
│ ├─ release JAVA_VERSION="25.0.4.1"
│ └─ serenity-native-release.properties
│ minecraftVersion=26.2, platform=windows-x64,
│ entrypoint=astralis.dll, ipcVersion=9
├─ Assets/ 5,715 Minecraft asset objects (vanilla 26.2)
├─ Game/ 14 entries — servers.dat, options.txt, usercache.json, debug logs
└─ Python/ 1 entry
```
### Runtime flow
1. `astralis.exe` parses the KAX container, writes all 22 records to disk, sets environment
variables, then `AddDllDirectory` → `LoadLibraryExW("compiled_launcher.dll")` →
`GetProcAddress("run_code")` → call.
2. `compiled_launcher.dll` (Nuitka C, Python 3.12) reads `launcher-settings.json`
(`{"memory_mb": 4096}`, validated 512–1048576), single-instance mutex
`Local\AstralisOfflineDesktop`, then spawns
`Runtime/serenity-client-host.exe` with `-Dserenity.guard=1 -Dserenity.launcher.pid=<pid>`.
3. `serenity-client-host.exe` (468 KB, GUI subsystem, MSVC) loads `Runtime/astralis.dll` and
calls the GraalVM exports `serenity_client_start` / `serenity_client_bind`.
4. `astralis.dll` is the whole Minecraft client, AOT-compiled by GraalVM.
---
## 4. `astralis.dll` — GraalVM native image
| Property | Value |
|---|---|
| Type | PE32+ DLL, x64, **no CLR**, **no .NET** |
| Image base | `0x180000000` |
| Entry | `0x132c9114` |
| Toolchain | **GraalVM CE 25.3.4.1+1.1**, SubstrateVM, MSVC 19.44.35229 |
| Java version | `25.0.4.1` |
| Sections | `.text` 321 MB `.svm_int` `.rdata` `.data` `.pdata` `.rodata` `.svm_hea` 1.58 GB `.vmp0` 23 MB `.reloc` |
| Exports | `serenity_client_start`, `serenity_client_bind`, `graal_create_isolate`, `JNI_CreateJavaVM`, `run_main`, `__svm_*` |
**`.vmp0` is not VMProtect.** Entropy 7.4, but no VMProtect strings, no VM handler tables, no
`VMProtectBegin` markers, no mutated epilogue. It is a GraalVM image section.
**Devirtualization is not applicable.** There is no JVM bytecode and no IL in this binary. The 1,370
`pub/astralis/client/*` "classes" (e.g. `A`, `A6`, `AA`, `pub.astralis.client.event.*`,
`pub.astralis.client.scripting.*`) exist only as:
- native code in `.text`,
- name metadata in `.svm_hea`,
- descriptor strings (`Lpub/astralis/client/A6;`).
Carving all `CAFEBABE` hits in the 1.93 GB image found **32,918 class files / 32,825 unique names —
zero of them `pub/astralis` or `com/astralis`**. Every one is JDK (`jdk/`, `sun/`, `java/`,
`javax/`, `com/sun/`). The app's own logic is machine code, not bytecode.
Embedded archives recovered from `.svm_hea` (33 clean ZIPs, all JDK jmods) plus one genuinely
app-owned archive:
### `astralis-scripting-api.jar` @ file offset `0x20e5d183`, 86 entries
Real, unobfuscated Java bytecode — the public **scripting API** that user scripts compile against.
Full surface dumped with `javap` (7,425 lines). Packages:
```
com/astralis/scripting/Script base class, ~50 event hooks
com/astralis/scripting/api/Client username, uuid, fps, ping, server address
com/astralis/scripting/api/World entities, blocks, raycast
com/astralis/scripting/api/Inventory slots, held item
com/astralis/scripting/api/Packets send/recv
com/astralis/scripting/api/Keybinds
com/astralis/scripting/api/Modules ScriptModule, ScriptModuleValue, ScriptMode
com/astralis/scripting/api/Storage
com/astralis/scripting/api/http/ScriptHttp sandboxed outbound HTTP
com/astralis/scripting/api/event/* Attack, BlockBreak, Chat, Input, Key, Motion,
MouseButton, MouseMove, Packet, Rotation, Screen,
Scroll, Sound, Tick, Velocity
com/astralis/scripting/api/render/* RenderContext, WorldRenderContext, TextBuilder
com/astralis/scripting/api/rotation/* RotationContext, RotationStrategy, Rotations
com/astralis/scripting/api/target/* TargetQuery, TargetSort, Targeting
com/astralis/scripting/api/math/* Vector2/3, BoundingBox, Noise, Rotation
com/astralis/scripting/api/props/* ScriptProperties, ScriptValue
com/astralis/scripting/api/hud/* Draggables, TargetHudRenderer
com/astralis/scripting/api/task/* ScriptTask, Tasks
com/astralis/scripting/api/screen/* ScriptScreen, ScriptScreens
com/astralis/scripting/api/json/* ScriptJson
```
`ScriptHttp` is a **deliberate, documented API for scripts to make web requests** with typed
failures (`DENIED`, `RATE_LIMITED`, `TIMEOUT`, `RESPONSE_TOO_LARGE`). It is a feature, gated by the
client — not an exfiltration channel baked into the free.
---
## 5. IOC sweep — all negative
Full unique string dump of the 1.93 GB image: **3,003,513 strings**. Sweeps run against it:
| Indicator class | Result |
|---|---|
| `discord.com/api/webhooks` / `webhook` / `api/webhooks` | **0 hits** |
| Discord token shape (`24-32.6.27-40`) | **0 hits** |
| `Login Data`, `Local State`, `leveldb`, `Web Data`, `cookies.sqlite`, `logins.json`, `key4.db` | **0 hits** |
| Chrome/Edge/Brave/Opera/Firefox/Yandex profile paths | **0 hits** |
| `CurrentVersion\Run`, `schtasks`, `TaskScheduler`, `Winlogon`, `UserInit` | **0 hits** |
| `wallet.dat`, Exodus, Electrum, MetaMask, keystore, Ledger | **0 hits** |
| Steam `ssfn`, `loginusers.vdf` | **0 hits** |
| `launcher_profiles`, `launcher_accounts`, `accessToken`, `refreshToken`, `clientToken` | **0 hits** |
| `GetAsyncKeyState`, `SetWindowsHookEx`, `WH_KEYBOARD` | only `GetKeyboardState@AwtToolkit`, `__imp_SetWindowsHookExW` — **AWT/JCEF internals** |
| `CreateRemoteThread`, `VirtualAllocEx`, `WriteProcessMemory` | only `VirtualAllocEx failed` / `CreateRemoteThread failed` — **statically-linked C++ error strings** |
| Cookie APIs | `N_VisitAllCookies`, `FOLDERID_Cookies`, `collectCookies`, `visitUrlCookies` — **JCEF/CEF browser API** |
| Clipboard | `OpenClipboard`/`GetClipboardData` — **LWJGL/GLFW** |
### Network
**2,432 unique URLs.** Every host is a library, doc, cert, or Mojang endpoint:
```
github.com en.wikipedia.org apache.org ns.adobe.com java.sun.com
schemas.microsoft.com aka.ms netty.io maven.apache.org
cacerts.digicert.com crl3.digicert.com crl.verisign.com
api.mojang.com sessionserver.mojang.com api.minecraftservices.com
discord.gg/SKb3aWTxkC (mod metadata description, not a C2)
discord.gg/viaversion (ViaVersion)
```
**No C2 host. No panel. No licence server. No paste site. No unknown domain.**
**99 unique IPv4 strings — every one is an ASN.1 OID** (`2.5.29.*`, `1.3.6.1.*`, `1.2.840.*`),
plus `127.0.0.1`, `0.0.0.0`, and `169.254.169.254` (AWS SDK metadata default shipped inside the JDK).
### The launcher makes zero network calls
`compiled_launcher.dll` string scan (56,039 strings) for `https?://|wss?://|ftp://` returned **three
matches, all irrelevant**: two XHTML DTDs and ` `.
### The host process has no HTTP stack
`serenity-client-host.exe` imports exactly: `ADVAPI32` (CryptGenRandom, SystemFunction036),
`KERNEL32`, and the UCRT. **No `winhttp`, no `wininet`, no `ws2_32`, no `urlmon`, no `wsock32`.**
It cannot make a network request.
### free-specific strings (all benign)
```
Astralis Offline single-instance mutex name
AstralisData / Local\AstralisOfflineDesktop
ASTRALIS_RUNTIME ASTRALIS_USER_DATA_ROOT ASTRALIS_EMULATOR_LOGS ASTRALIS_LAB
serenity-device-key-v1 serenity-dh-v2 serenity-device-proof-v1 serenity-offline-lab-epoch
serenity-ipc-frame serenity-ipc-v1 serenity-xfer-v1 serenity-pkt-v2
C:\Users\Public\SerenityOfflineLab\release
-Dserenity.guard=1 -Dserenity.launcher.pid=
```
That is the **offline licence emulation**: device-key / Diffie-Hellman / device-proof replaced with
local stubs, epoch pinned, IPC framed locally. No phone-home.
---
## 6. What the free actually did
The original paid client ships its own protection:
- `serenity/protection/windows-x86_64/serenity_keys.dll` — **referenced in the resource table, NOT
present in `payload.dat`**. It was stripped.
- `META-INF/serenity-vmp/full-methods` — VMProtect-style method virtualisation manifest from the
original build. Metadata only; the virtualised bodies are gone.
- `serenity_dump_detection::Monitor:oll` / `monitor_mutex` — an **anti-dump / anti-debug thread**
that is still compiled into `astralis.dll`. It watches for debugger/dumper artefacts. It is the
client's own DRM, not a payload, and it does not phone home.
The cracker's move was: strip the licence check, strip `serenity_keys.dll`, then AOT-compile the
entire client with GraalVM `native-image` so there is no JVM bytecode to decompile or patch.
---
## 7. Evidence of real use (baked into `payload.dat`)
```
Game/options.txt lastServer:hypixel.net, telemetryOptInExtra:false
Game/usercache.json Offline, cat7hia7z, drcrypter, DrCrypter, fernan54869, hello
Game/debug/disconnect-2026-11-09_16.42.05-client.txt
java.net.SocketException: Connection reset
at [email protected]/... / io.netty.channel.socket.nio.NioSocketChannel
Game/servers.dat anticheat-test.com, ...
```
The build was made and run by the cracker against Hypixel. The debug log confirms the client runs
on JDK 25 + Netty and connects to real Minecraft servers — normal cheat-client traffic.
---
## 8. Residual risk
1. **It is a game cheat.** On Hypixel it is bannable; the client is built to evade anti-cheat.
2. **`serenity_dump_detection`** spawns a monitor thread that inspects the process for debuggers and
memory dumpers. If you plan to attach a debugger or dump memory, expect it to react.
3. **GraalVM native image at 1.93 GB** with 32k+ embedded JDK classes and 22k mod resource paths is
effectively opaque to conventional decompilation. Static coverage is: full string space, full
import/export table, full container/archive carving, all class files. What is **not** covered:
per-instruction semantics of the 321 MB `.text` — the cheat's module logic is machine code and
was not symbolically reconstructed.
4. **The script API allows scripts to make HTTP requests** (`ScriptHttp`). If you load third-party
Astralis scripts, those can exfiltrate whatever the API exposes (`Client.getUsername()`,
`getUuid()`, server address). The risk lives in the scripts, not the binary.
5. **Nothing in this package was executed.** All conclusions are static. A dynamic run in an
isolated VM with a network capture would be the confirming step, and it was deliberately skipped
per instruction.
---
## 9. Extracted artifacts
```
_analysis/
compiled_launcher.dll Nuitka Python 3.12 launcher
serenity-client-host.exe GUI host, loads astralis.dll
astralis.dll GraalVM CE 25.3.4.1 native image
Runtime_astralis.dll.zst zstd source
Runtime_release / Runtime_serenity-native-release.properties / Runtime_lib_jvm.cfg
Game_servers.dat / Game_options.txt / Game_usercache.json / Game_debug_disconnect-*.txt
jars/astralis-scripting-api.jar 86-entry Java scripting API
jars/scriptapi/ extracted .class files
jars/scriptapi_full.txt javap -p -c dump (7,425 lines)
classes/index.txt 32,825 carved class names (all JDK)
```