Tales from RatRater2: detecting Quantiy

July 25, 2026

RatRater is a tool that uses static analysis to detect Minecraft infostealers I originally made in 2022. In 2023, a new maker of infostealers entered the scene: Quantiy. He seemed like an average infostealer developer that I could detect with searching for com/quantiy and EncryptionMethod1337 and 3 9-character filenames and 10+ 15-character functions and call it a day. On June 10 2023, I quickly realized I was wrong: he was smarter than most, actively removing my keywords from his infostealers, even breaking my crazy regex /\w{43}==\w{43}[_\/\\\-!|I]{13,15}F\w\-\w{7}-\w{7}-\/\/D\w{13}-\w{4}\/\/I\w{3}\-\w{7}\-\w{5}V\/\/E[a-z]\-\w{5}\-\w{5}\-\w{1}C\w{1}R\/\/E.{15}/. And so I added a closed source backend to RatRater2, which I can finally share today.

Main heuristic

This is a 7 pronged heuristic, tripping with high confidence at 12+ points and with medium confidence at 11+ points. Factors:

• (factor A, 3 points) just one class

• (factor B, 3 points) just one class nested 3 directories deep - detected with /^\w{2,12}\/\w{2,12}\/\w{2,12}\.class$/

• (factor C, 1 point) just one non-class

• (factor D, 1 point) just one non-class that is META-INF/MANIFEST.MF

• (factor E, 1 point) the full META-INF/MANIFEST.MF is just Manifest-Version: 1.0 with two newlines after

• (factor F, 2 points) the first class has more than 20 TY - explained in the next section

• (factor G, 2 points) the first class has reverse and base32 - explained in the next section

Injection heuristic

What's worse than closed source, heuristics, and closed source heuristics? 2 closed source heuristics. When Quantiy made a second type of infostealer, one that injects itself into existing mods, I had to make this heuristic that trips with high confidence at 8+ points and with medium confidence at 7+ points. Factors:

• (factor a, 2 points) 2+ classes and has manifest

  This factor is basically "does it look based on a real mod".

• (factor b, 6 points) class ends with UtilsUtils.class

  Quantiy's injected classes often copied existing classes and added "Utils" to blend in. This backfires when the existing class already has "Utils".

• (factor c, 2 points) more than 20 TY in any class ending with Utils.class

  Quantiy's injections are obfuscated, which creates what looks like a lot of TYs in their bytecode in the process.

• (factor d, 2 points) reverse and base32 in any class ending with Utils.class

  Detects how Quantiy reverses and encodes strings like webhooks.

How did they work?

They did their job of detecting Quantiy and preventing him from avoiding detection well. But the heuristic system itself, at least with the current thresholds (I believe they weren't always at these levels), does a better job at preventing false positives than preventing Quantiy from bypassing detection - my logic literally said "anything under 80% of flags shouldn't trip detection".