Prestige Client Security Research

Question

Can the Prestige Client execution chain be evaluated from captured binaries without turning antivirus labels, sandbox noise, or community claims into conclusions?

Captured evidence

• Prestige-Client.exe outer loader• Captured injector.dll controller• Exact SHA-256 sample identities• Static-analysis artifacts only — suspicious binaries are not redistributed

Execution chain

The outer executable contacts the Prestige API, downloads a PE32+ DLL, checks only enough structure to map it, resolves imports and relocations, applies memory protections, runs initialization code, locates JNI_OnLoad, and invokes it from memory. There is no expected payload hash, Authenticode signature, or publisher verification before that downloaded code executes.

Observed trust chain

Prestige loader
POST /injectorDownload
Unsigned controller DLL
Manual map + JNI_OnLoad
POST /injectionDownload
Remote Minecraft injection

Confirmed findings

The captured controller contains two Minecraft injection paths: remote manual mapping and a LoadLibraryA fallback. It also includes anti-debug and anti-VM checks, analysis-tool process blacklisting, and persistent hardware fingerprinting based on WMI fields and MachineGuid. The important security result is narrower than calling the client a specific malware family: the captured chain permits server-selected unsigned PE payloads to be downloaded and executed or injected without an independently verifiable code identity.

Evidence discipline

The repository keeps a claim-by-claim evidence ledger with addresses, file offsets, limitations, and source quality. Exact sample bytes and uninterrupted code/data flow are treated as primary evidence; sandbox or antivirus classifications are correlation only. That distinction also corrected one circulating claim: in the captured controller, the first-login password is SHA-256 hashed and hex encoded before it enters the JSON request. The analysis therefore does not claim that this exact DLL sends that password in plaintext.

What is deliberately not claimed

The unavailable authenticated third stage was not captured. The project therefore does not claim proof of a RAT command loop, browser credential theft, keylogging, clipboard capture, persistence, privilege escalation, ransomware, or attribution to a named malware family. This boundary is part of the result: a security investigation should make the strongest claim supported by the evidence, not the strongest claim suggested by suspicion.

Reproducibility

The public repository contains the report, loader and injector static-analysis notes, IOC JSON, YARA rules, an integrity manifest, and a non-executing helper for capturing the unavailable stage in an isolated environment. Suspicious sample binaries are intentionally excluded. Read the report, evidence ledger, and detection artifacts on GitHub.

Related projects

XDNA NPU Miner

Experimental

PythonAIE2MLIR-AIEXRTRyzen AI

★ 0 stars⑂ 0 forks◌ 45 commits◉ 0 issues

C++Updated Aug 12, 2026

An early-stage research project exploring whether suitable cryptocurrency mining kernels can be mapped honestly and measurably onto AMD XDNA1 NPUs.

Read case study View project

Samsung Odyssey G5 Firmware Research

Research

PythonSPARC V88051FirmwareReverse Engineering

★ 17 stars⑂ 0 forks◌ 20 commits◉ 0 issues

PythonUpdated Aug 27, 2026Release v1.0.0

Reverse engineering and reproducible tooling for the Samsung Odyssey G5 G55C firmware, including a minimal patch that exposes an existing hidden factory page.