Anyone have a clue on the attack vector? A reddit post said that the presence of the "/Library/Application Support/JavaW" indicates an infected system. Flash? Java?
Perhaps some kind of pirated Minecraft client is the vector? Java is needed, mods to that area are probably ignored, and the malware is connecting to a Reddit Minecraft forum which is something that is almost certainly not blocked by the victim if they're a player/fan.
I know a lot of malware checks google.com to see if they are connected to the internet, as it is usually a site that is up and not blocked. Haven't looked into it yet to see if this is the case as well
