RATScope
Static JAR analyzer
How it works Try a sample Runs in your browser
Private static analysis — no server upload

Is that .jar hiding a RAT?

Drop a Minecraft client, mod or plugin and RATScope inspects the bytecode, resources and manifest for remote-access trojans, backdoors and stealer patterns — entirely on your device.

Drop a .jar file here

or click to browse — up to 50 MB

Supports .jar .zip .mcpack .mrpack
Files never leave your device
SHA-256 fingerprint
40+ detection rules
file.jar
Reading archive…

—

—

Detections

0 findings

Archive contents

0 files

AI analysis Gemini

Heuristic tool, not a verdict of guilt. RATScope flags suspicious patterns in bytecode and resources. Legitimate mods can use networking or reflection, and advanced malware can hide from static analysis. Always cross-check a critical result with a sandbox or a second scanner before running anything.

How RATScope works

A .jar is a ZIP archive of compiled Java classes and resources. RATScope unzips it in memory, then for every .class and text resource it:

  1. Extracts readable strings from the constant pool & bytecode.
  2. Matches them against 40+ rules: C2 URLs, Discord webhooks, Runtime.exec, ProcessBuilder, reflection loaders, base64 payloads, Windows persistence, token stealers and known RAT signatures.
  3. Scores findings by severity and computes a SHA-256 fingerprint you can look up on threat databases.

Everything runs in JavaScript on your machine — nothing is uploaded, which keeps unknown samples contained.